Subject: [quicwg/base-drafts] AEAD Associated Data (#243)

From: martinduke <[email-masked]>
Date: Thu, 26 Jan 2017 12:52:38 -0800

The TLS draft currently states that the associated data for AEAD encryption is the empty sequence. This is a deviation from legacy QUIC, which uses the public header as associated data and thus authenticates those fields. Packet number authentication is already accomplished due to its inclusion in the IV.

In Tokyo, there was considerable interest in a couple of features that require integrity of Public Header fields:
- Greasing the unused bits in the Public flags
- The connection ID may be used for routing.

It is probable that firewalls might block unused public flag bits, particularly if any middlebox could potentially alter them without detection to send a signal.

Therefore, I suggest that we restore use of the full publice header as associated data. I see no reason that this would impose excessive costs on the receiver.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/243

---

From: ianswett <[email-masked]>
Date: Thu, 26 Jan 2017 14:20:13 -0800

I would agree with this proposal, for all the reasons you mentioned.  This becomes critical if anything new is added in the unencrypted portion of the packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/243#issuecomment-275532273