Re: Packet Number Encryption outside of AEAD

[Mikkel Fahnøe Jørgensen <[e-mail]>]

Yes ideally you should include the packet length in AEAD, which of course
is the case already for long packet headers.

But on the other hand, it is widely accepted in cryptography that is is
safe to send the IV in clear text, and if isn’t, something else is wrong,
so from that point of view there shouldn’t be any dangers. Still it is
mildly disturbing that a verified tag does not correspond to single packet
size.

AES-GCM already includes a length in it’s tag, but it does of course not
cover content it does not include.

I’m not sure if it is reasonable to require a PN always being sent with the
shortest length possible, but it sure would save space on the wire.

Mikkel

On 27 July 2018 at 06.14.16, Kazuho Oku ([e-mail]) wrote:

2018-07-26 15:21 GMT+09:00 Mikkel Fahnøe Jørgensen <[e-mail]>:
> I created the following issue a while ago but go no response, so perhaps
it
> should have been discussed on this list:
>
> https://github.com/quicwg/base-drafts/issues/1578
>
> The issues covers the point, but in summary:
>
> If the packet format is kept as it is today, but the packet number is not
> included in the authenticated data when computing the AEAD tag, then the
> decoder need not modify the received packet buffer when decoding the
packet
> number. This can lead to more efficient hardware implementations and make
> multi-processor buffer sharing more effective.

I am not sure if this is a safe change.

What makes me worried is the fact that we will now have at most three
ways of representing a packet. My understanding is that having
indeterministic encoding is considered dangerous in crypto.

Consider the case where a sender encodes a packet number using 4
octets even when just using 1 octet is enough.

An on-path attacker rewrites the packet by applying XOR 0x80 to the
first octet of the encrypted PN, and trimming the latter three octets
of the encrypted PN.

Then, the attacker can observe if the packet is successfully consumed
by the receiver, and use the fact to infer if the upper 6 bits of the
30-bit PN was equal to the least 6 bits.

I am not sure if this attack is interesting, but allowing multiple
representation does create these kind of attack vectors.

>
> Mikkel



-- 
Kazuho Oku