Re: Packet number encryption

[Christian Huitema <[e-mail]>]

On 2/1/2018 2:56 PM, Kazuho Oku wrote:
> 2018-01-31 19:00 GMT+09:00 Eggert, Lars <[e-mail]>:
>> On 2018-1-31, at 10:52, Gorry Fairhurst <[e-mail]> wrote:
>>> +1 - Simply: This *is* complicated and seems to add little.
>> So as an implementor (chair hat off), this adds very little to the overall complexity of the protocol.
> +1
>
> The algorithm defined in the PR is easy to implement.
>
> When using OpenSSL what you need to do is:
>
> * when switching to a new pn_key, call EVP_EncryptInit_ex to setup a
> CTR cipher (e.g., EVP_aes_128_ctr, EVP_chacha20) along with the pn_key
> passed as the argument.
>
> * for each packet, call EVP_EncryptInit_ex to set the IV to the 16
> bytes of the AEAD ciphertext, then call EVP_EncryptUpdate to obtain
> the encrypted packet number
>
> Decryption is exactly the same as encryption, since it is CTR mode.
>
> To me it seems that using packet number encryption actually simplifies
> the implementation, since we no longer need to care about randomizing
> the initial packet number or implement special measures to avoid
> linkability when switching to a new CID.

+1.

By the way, I wrote a small test vector for the PN encryption using AES,
at
https://github.com/quicwg/base-drafts/wiki/Test-vector-for-AES-packet-number-encryption.

-- Christian Huitema