Re: New confidentiality and integrity limits

[Jana Iyengar <[e-mail]>]

Chris, (and all others involved),

Thank you for all the analysis and for distilling it into the
recommendations above -- the more precise bounds are super helpful!
It seems to me that the other limits are not practical limits for the most
part. Am I correct in understanding that the practical impact of this boils
down to "We might need to do key updates more frequently than we had hoped"
since the integrity limits are a bit more modest?

I've left some comments on the PR.

Thanks again,
- jana

On Thu, Jun 25, 2020 at 4:45 PM Martin Thomson <[e-mail]> wrote:

> On Fri, Jun 26, 2020, at 04:29, Christopher Wood wrote:
> > As Martin noted, for the integrity limit, the story is slightly
> > different. Key updates do not help there.
>
> Or we don't know that they do...  There are still a lot of unanswered
> questions.  We do know that a forgery attempt against one key is likely
> still good for a different key on the same connection.  It might not be
> good for another connection (the inclusion of connection IDs might help us
> here, but that's another unknown - and unreliable - factor) but we can't
> really control for that.  So we chose something we believe to be both
> conservative and practical.
>
> The forgery limits are still quite generous: if you have to drop a
> connection due to that many forgeries, then I'd suggest that something is
> seriously wrong.
>
>