Re: New confidentiality and integrity limits

Jana Iyengar <> Fri, 26 June 2020 01:01 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C203C3A10B7 for <>; Thu, 25 Jun 2020 18:01:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id fdxgZNhRCFNL for <>; Thu, 25 Jun 2020 18:01:17 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 4201F3A1046 for <>; Thu, 25 Jun 2020 18:01:17 -0700 (PDT)
Received: by with SMTP id h19so8512317ljg.13 for <>; Thu, 25 Jun 2020 18:01:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cXONsrlIZNQNgHHOK4EepstCxg34Yc12VfYPR0r5HX4=; b=G4xBHZRl/lOMyuPJOF89qyf0XHB0QURgjFxHDrWC/JSkZgrwRTaXvL9apdupPWzyvM lfbncbLzxHlk1zMciDmJJ052RSkr6K0y5RRBBc9ylUwNIUqii+uYvn705gmAW99UhDeE svit4sTO6izbqSP6eRpvweso3WGuZFZZc42EjPdahqxQYLRLg2MD9JSovzvwYOuD58Z2 +lMeFoZQh4J77fUro95kU2nFJYyHbnkVXxml/r/ISvoigK6uc105HuegWEdqanMrTsBX TUgxwXMY66P4wb20Kzpmdu93+QSLLWLC8gGGLwJgw7jgW+bUafi1vum4DPnx57GtUHa/ WAyg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cXONsrlIZNQNgHHOK4EepstCxg34Yc12VfYPR0r5HX4=; b=m12Up12EkEFvxcaJjZxitKq5YfgO3/zUlYvW8mMGdGdg59ubzpOcS97U+/agDx5Crm H493VYYFqnegLeevUZH9BA0Zpae1ZJS2WGaTexaWoFDPGf3dB7468Cdp5jQOf2iVkA2S nN120gDvW1QjrbejVqi74JXBH3otKZe4wkm1oTneOTC3sAl5/f6GL+CejrLPJJXBcy1C 5mIgPf+eznP0ngNgizxlCtlyWmJlfco78HCagHFKbAc+SC3+70BXm2H/n5BjFp4k7Jcb HBBc7BQHSaF66wZrzGppOGP+UDlGO1+ivKowqb6ZyTEhLJfptifCGEROhVsoq6leov6o d0WA==
X-Gm-Message-State: AOAM532USCVlEykYBJ9jUFf4LSS0w9ioJzGFyWZDPQicL+IJmCtqpTkO t7wy69PeYjWykDjAuHA11A8u9PZjJ4k+TClB0Yc=
X-Google-Smtp-Source: ABdhPJx0272g5QahSgqO6YlQ0Kc8xQIouBMz8tBnkghXApmUUkMcj8mKP9PXQx5UL/5gxvbZDZYxuuGkzPHmYGPdDAA=
X-Received: by 2002:a2e:860d:: with SMTP id a13mr190563lji.344.1593133275229; Thu, 25 Jun 2020 18:01:15 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <>
In-Reply-To: <>
From: Jana Iyengar <>
Date: Thu, 25 Jun 2020 18:01:04 -0700
Message-ID: <>
Subject: Re: New confidentiality and integrity limits
To: Martin Thomson <>
Cc: QUIC WG <>
Content-Type: multipart/alternative; boundary="000000000000f3336905a8f23e25"
Archived-At: <>
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 26 Jun 2020 01:01:19 -0000

Chris, (and all others involved),

Thank you for all the analysis and for distilling it into the
recommendations above -- the more precise bounds are super helpful!
It seems to me that the other limits are not practical limits for the most
part. Am I correct in understanding that the practical impact of this boils
down to "We might need to do key updates more frequently than we had hoped"
since the integrity limits are a bit more modest?

I've left some comments on the PR.

Thanks again,
- jana

On Thu, Jun 25, 2020 at 4:45 PM Martin Thomson <> wrote:

> On Fri, Jun 26, 2020, at 04:29, Christopher Wood wrote:
> > As Martin noted, for the integrity limit, the story is slightly
> > different. Key updates do not help there.
> Or we don't know that they do...  There are still a lot of unanswered
> questions.  We do know that a forgery attempt against one key is likely
> still good for a different key on the same connection.  It might not be
> good for another connection (the inclusion of connection IDs might help us
> here, but that's another unknown - and unreliable - factor) but we can't
> really control for that.  So we chose something we believe to be both
> conservative and practical.
> The forgery limits are still quite generous: if you have to drop a
> connection due to that many forgeries, then I'd suggest that something is
> seriously wrong.