Re: Forgery limits in QUIC

[Matt Joras <[e-mail]>]

On Thu, Apr 30, 2020 at 11:15 PM Martin Thomson <[e-mail]> wrote:

> OK, I thought this would be easy.  I was wrong.  But it still might be
> easy.
>
> The draft currently defines four AEAD functions.  We have a good analysis
> for three of those functions.  We lack an analysis of the last.  That is
> AEAD_AES_128_CCM.
>
> It turns out that we never really had a good analysis of CCM.  TLS 1.3
> conveniently fails to say anything about it.
>
> My suggestion is that we remove CCM from QUIC until we have an
> understanding of its robustness against confidentiality attacks with
> multiple successful applications of protection AND integrity attacks with
> multiple forgery attempts.  We need to base our recommendations about
> limits on something more than what we have now.
>
> I realize that this is a fairly dramatic change, but I think we need to
> hold our ciphers to a high standard.  I will attempt to find an analysis
> myself, as I would expect it to exist, but I have a poor history of success
> finding the right cryptographic paper.  If anyone is able to provide
> pointers, that would be appreciated.
>
Is it actually a fairly dramatic change? The supported cipher suite is not
a huge consideration for us, and I would guess this is generally true.
We've only implemented AEAD_AES_128_GCM and AEAD_AES_256_GCM. Perhaps this
is more of a concern for those wishing to ship embedded stacks, since AFAIK
CCM is nominally simpler to implement?

Removing it seems straightforward unless someone was has a good reason to
want to ship CCM specifically.


> On Fri, May 1, 2020, at 14:45, Martin Thomson wrote:
> > I have just opened https://github.com/quicwg/base-drafts/issues/3619
> >
> > tl;dr We need to recommend limits on the number of failed decryptions.
> >
> > I am now working on a pull request to add this to the spec.
> >
> > I realize that we're nearing the end, but this is an important security
> > improvement and the result of some good work by cryptography
> > researchers, who have done a lot to improve our confidence that QUIC
> > can deliver on its promises of providing confidentiality and integrity..
> >
> > A big thanks to Felix Günther, Marc Fischlin, Christian Janson, and
> > Kenny Paterson for their work on this.
> >
> >
>
>