RE: Packet number encryption

[Mikkel Fahnøe Jørgensen <[e-mail]>]

On 9 February 2018 at 22.18.18, Mikkel Fahnøe Jørgensen ([e-mail])
wrote:

If we enumerate each half-path with a path ID PID as a simpler counter
starting at zero, we have a 1-1 mapping from PID to CID. The packet number
PN is then encoded as <PID * 2^32 + nonce counter>. The PN is used
explicitly and implicitly in ACK frames but is never carried directly on
the wire.

Using a segment packet number space can also be used to deal with
optimistic ACK attacks:

Each path is given two connection ID’s which may very just at the lower
bit. Rather than randomly skipping some packet numbers, a few packets could
be sent on the alternative CID. This will introduce gaps but each nonce
range remains gapless which keeps the ACK frame defragmented and avoids
false loss signals. It does required that CID is present on the wire, but
if it is not, a single header bit could be used to imply which of packet
number segments is in use. On its own this is not a very attractive ack
attack solution, but it may be relevant if packet numbers are segmented,
and especially with a v2 multi-path solution.