IETF Logo Mail Archive

Re: Packet number encryption

Kazuho Oku <kazuhooku@gmail.com> Fri, 02 February 2018 00:56 UTC

Return-Path: <kazuhooku@gmail.com>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3468012DA3D for <quic@ietfa.amsl.com>; Thu, 1 Feb 2018 16:56:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ToWk97K5nmcG for <quic@ietfa.amsl.com>; Thu, 1 Feb 2018 16:56:08 -0800 (PST)
Received: from mail-pf0-x229.google.com (mail-pf0-x229.google.com [IPv6:2607:f8b0:400e:c00::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 835FE126DED for <quic@ietf.org>; Thu, 1 Feb 2018 16:56:08 -0800 (PST)
Received: by mail-pf0-x229.google.com with SMTP id a88so16379073pfe.12 for <quic@ietf.org>; Thu, 01 Feb 2018 16:56:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Kyb1n5XOOIIuOy4EPBx/LBkaO6afUWLITkmU5wymnAg=; b=VyHmkKNYQdAqD3b+mPYDWqFAqeKY5GgRBr5KLqVq7nmfJD+GWql1TC+5hOsA1LknZG j1lkJ/dH52EF3EYZQuDDKSccJ0TYj4pKd8qunlFUvmZQwgwpgCdSfNsqed5ZDdOafLNz Gi3CneVy2EPVVyPnZuUYSW3e404cm4eaxS7sJPTpFPWchi59FTAkmDBB2+XHFHw2/4S4 th99tFdwBOWHt1C7TSllANEEmxiLm03r9C734HaarcdlvIEALWCRQSb9W5Xqz6XqBrxb Cyg89pY/vXyod4B6S/gfjsokToAssPA28H9JOCOjlts728+iLjSVayf77CWFpD6fFHro cBcA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Kyb1n5XOOIIuOy4EPBx/LBkaO6afUWLITkmU5wymnAg=; b=pXMlcFrkP6Z/vySwT7mbdsE85OKDR9ozdvHPXFuEaAit774e7LYZcifMwgkOjpSzxQ tKCN2hJzz/wSpEtXRDOhFXKIk4lLir0hqOaY9E2YX2DjmBoQNSGJ2eksXWgRbL2GaJ1i 2Z6AixmXXkNNxxRTb0iHTWZx9TZz3KJ3rf3AXpunRYgOb/f6TljNu9r4KYuxMYQATheR m6PDAKK8cUaeAjxwY9rhx4MIYDI8I52Wa4Zva+CNMPpUmRwY+p2hJYHBJQjC4driHzNo uqXAgBeshAr1pSY7WaFqjQhqLarIwksOrrZQUraH61qaPAYdo7cuo3dGWS+hz5C/RNrM P3oA==
X-Gm-Message-State: AKwxytdF0aCl+76kcybWrcbtGbDpYpTNgHE25vAmz5f1+C69tCWvDgIK 2TVvktL52VXrIWuJVFDXS+jSsEj8FCBfQuUkHAueqw==
X-Google-Smtp-Source: AH8x226xPyjmWXEBYQUCZH5yWXUw1Dc0jCuqlF7L+PjwKIAcjPdh7czE9j0yDyer7sdyIL4hfFFU+Jt25k3TvKHYFLI=
X-Received: by 10.99.123.78 with SMTP id k14mr135969pgn.173.1517532967921; Thu, 01 Feb 2018 16:56:07 -0800 (PST)
MIME-Version: 1.0
Received: by 10.236.156.11 with HTTP; Thu, 1 Feb 2018 16:56:07 -0800 (PST)
In-Reply-To: <5214AD93-8376-4B25-922F-AF5551CC2E95@netapp.com>
References: <CABkgnnVyo3MmWtVULiV=FJTnR528qfY8-OmKGWAs0bCvri-a_g@mail.gmail.com> <1F7FB3B8-A94C-4354-9944-FB09FB8DB68B@trammell.ch> <CABcZeBMbwdwyC9TxxHBLYaZKfNB-FG2wCGjqUZ_mNR-A1R47FA@mail.gmail.com> <9096e5ec-581e-875a-b1dd-bff0b05206fd@huitema.net> <CABkgnnWRQSAufwPss+qf=xAzCwRYeNNH8XLPm3yFaHxOb+ba4g@mail.gmail.com> <BF80500A-6277-45DC-8525-9C3FE138B76D@tik.ee.ethz.ch> <5A7191E0.6010003@erg.abdn.ac.uk> <5214AD93-8376-4B25-922F-AF5551CC2E95@netapp.com>
From: Kazuho Oku <kazuhooku@gmail.com>
Date: Fri, 02 Feb 2018 09:56:07 +0900
Message-ID: <CANatvzwoih1zXo6iG3XL=xM3xmN-QX_fiSb5wBBUdmdr926URw@mail.gmail.com>
Subject: Re: Packet number encryption
To: "Eggert, Lars" <lars@netapp.com>
Cc: Gorry Fairhust <gorry@erg.abdn.ac.uk>, Eric Rescorla <ekr@rtfm.com>, Mirja Kühlewind <mirja.kuehlewind@tik.ee.ethz.ch>, Christian Huitema <huitema@huitema.net>, Brian Trammell <ietf@trammell.ch>, QUIC WG <quic@ietf.org>, Martin Thomson <martin.thomson@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/k6eGUju5JKRxPHpCc6JDAq-_9gk>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Feb 2018 00:56:10 -0000

2018-01-31 19:00 GMT+09:00 Eggert, Lars <lars@netapp.com>:
> On 2018-1-31, at 10:52, Gorry Fairhurst <gorry@erg.abdn.ac.uk> wrote:
>> +1 - Simply: This *is* complicated and seems to add little.
>
> So as an implementor (chair hat off), this adds very little to the overall complexity of the protocol.

+1

The algorithm defined in the PR is easy to implement.

When using OpenSSL what you need to do is:

* when switching to a new pn_key, call EVP_EncryptInit_ex to setup a
CTR cipher (e.g., EVP_aes_128_ctr, EVP_chacha20) along with the pn_key
passed as the argument.

* for each packet, call EVP_EncryptInit_ex to set the IV to the 16
bytes of the AEAD ciphertext, then call EVP_EncryptUpdate to obtain
the encrypted packet number

Decryption is exactly the same as encryption, since it is CTR mode.

To me it seems that using packet number encryption actually simplifies
the implementation, since we no longer need to care about randomizing
the initial packet number or implement special measures to avoid
linkability when switching to a new CID.

> Lars



-- 
Kazuho Oku

v2.23.0 | Report a Bug | By Email