Re: [Sframe] John Scudder's No Objection on draft-ietf-sframe-enc-07: (with COMMENT)

[Richard Barnes <[e-mail]>]

Not unreasonable.  Wrote up a PR:

https://github.com/sframe-wg/sframe/pull/197

On Wed, Apr 3, 2024 at 12:39 PM John Scudder <[e-mail]> wrote:

> On Apr 3, 2024, at 11:39 AM, Richard Barnes <[e-mail]> wrote:
>
> The high-level message, though, is that `SFrameContext::decrypt()` should
> be a constant-time operation, irrespective of whether the decryption is
> successful or not.  I think the current text is close enough to capture
> that, but would be open to clarifying further.
>
>
> The attack I can imagine that isn’t captured by your discussion is that
> (as hinted in my earlier comment) an attacker on (or in sight range of!)
> the subject endpoint could potentially know by visual inspection, or
> equivalent, that a keyframe had been dropped. Still up to you whether you
> want to take this on board, though. I think the additional clarity provided
> by your specific observation that "`SFrameContext::decrypt()` should be a
> constant-time operation” seems more valuable overall. One way to write that
> could be,
>
> OLD:
>             Invalid ciphertexts SHOULD be discarded
>    in a way that is indistinguishable (to an external observer) from
>    having processed a valid ciphertext.
>
> NEW:
>             Invalid ciphertexts SHOULD be discarded
>    in a way that is indistinguishable (to an external observer) from
>    having processed a valid ciphertext. In particular the decrypt()
>    operation should be constant-time, irrespective of input.
>
> And thanks for the context about compressed CTR.
>
> —John
>