Re: Forgery limits in QUIC

[Martin Thomson <[e-mail]>]

OK, I thought this would be easy.  I was wrong.  But it still might be easy.

The draft currently defines four AEAD functions.  We have a good analysis for three of those functions.  We lack an analysis of the last.  That is AEAD_AES_128_CCM.

It turns out that we never really had a good analysis of CCM.  TLS 1.3 conveniently fails to say anything about it.

My suggestion is that we remove CCM from QUIC until we have an understanding of its robustness against confidentiality attacks with multiple successful applications of protection AND integrity attacks with multiple forgery attempts.  We need to base our recommendations about limits on something more than what we have now.

I realize that this is a fairly dramatic change, but I think we need to hold our ciphers to a high standard.  I will attempt to find an analysis myself, as I would expect it to exist, but I have a poor history of success finding the right cryptographic paper.  If anyone is able to provide pointers, that would be appreciated.

On Fri, May 1, 2020, at 14:45, Martin Thomson wrote:
> I have just opened https://github.com/quicwg/base-drafts/issues/3619
> 
> tl;dr We need to recommend limits on the number of failed decryptions.
> 
> I am now working on a pull request to add this to the spec.
> 
> I realize that we're nearing the end, but this is an important security 
> improvement and the result of some good work by cryptography 
> researchers, who have done a lot to improve our confidence that QUIC 
> can deliver on its promises of providing confidentiality and integrity.
> 
> A big thanks to Felix Günther, Marc Fischlin, Christian Janson, and 
> Kenny Paterson for their work on this.
> 
>