Re: Forgery limits in QUIC

[Martin Thomson <[e-mail]>]

Good news. We saved CCM.

I consider the pull to be ready for review.  Felix has validated - and corrected - the analysis. Antoine has promised to double check the numbers.  More eyes would be good.

On Fri, May 1, 2020, at 16:14, Martin Thomson wrote:
> OK, I thought this would be easy.  I was wrong.  But it still might be easy.
> 
> The draft currently defines four AEAD functions.  We have a good 
> analysis for three of those functions.  We lack an analysis of the 
> last.  That is AEAD_AES_128_CCM.
> 
> It turns out that we never really had a good analysis of CCM.  TLS 1.3 
> conveniently fails to say anything about it.
> 
> My suggestion is that we remove CCM from QUIC until we have an 
> understanding of its robustness against confidentiality attacks with 
> multiple successful applications of protection AND integrity attacks 
> with multiple forgery attempts.  We need to base our recommendations 
> about limits on something more than what we have now.
> 
> I realize that this is a fairly dramatic change, but I think we need to 
> hold our ciphers to a high standard.  I will attempt to find an 
> analysis myself, as I would expect it to exist, but I have a poor 
> history of success finding the right cryptographic paper.  If anyone is 
> able to provide pointers, that would be appreciated.
> 
> On Fri, May 1, 2020, at 14:45, Martin Thomson wrote:
> > I have just opened https://github.com/quicwg/base-drafts/issues/3619
> > 
> > tl;dr We need to recommend limits on the number of failed decryptions.
> > 
> > I am now working on a pull request to add this to the spec.
> > 
> > I realize that we're nearing the end, but this is an important security 
> > improvement and the result of some good work by cryptography 
> > researchers, who have done a lot to improve our confidence that QUIC 
> > can deliver on its promises of providing confidentiality and integrity..
> > 
> > A big thanks to Felix Günther, Marc Fischlin, Christian Janson, and 
> > Kenny Paterson for their work on this.
> > 
> >
> 
>