Re: [Sframe] John Scudder's No Objection on draft-ietf-sframe-enc-07: (with COMMENT)

[John Scudder <[e-mail]>]

On Apr 3, 2024, at 11:39 AM, Richard Barnes <[e-mail]> wrote:

The high-level message, though, is that `SFrameContext::decrypt()` should be a constant-time operation, irrespective of whether the decryption is successful or not.  I think the current text is close enough to capture that, but would be open to clarifying further.

The attack I can imagine that isn’t captured by your discussion is that (as hinted in my earlier comment) an attacker on (or in sight range of!) the subject endpoint could potentially know by visual inspection, or equivalent, that a keyframe had been dropped. Still up to you whether you want to take this on board, though. I think the additional clarity provided by your specific observation that "`SFrameContext::decrypt()` should be a constant-time operation” seems more valuable overall. One way to write that could be,

OLD:
            Invalid ciphertexts SHOULD be discarded
   in a way that is indistinguishable (to an external observer) from
   having processed a valid ciphertext.

NEW:
            Invalid ciphertexts SHOULD be discarded
   in a way that is indistinguishable (to an external observer) from
   having processed a valid ciphertext. In particular the decrypt()
   operation should be constant-time, irrespective of input.

And thanks for the context about compressed CTR.

—John