Subject: Re: [quicwg/base-drafts] Specify AEAD-based protection of cleartext packets (#693)

From: janaiyengar <[email-masked]>
Date: Tue, 01 Aug 2017 23:58:27 +0000 (UTC)

I like ekr's proposed approach. The VN packet currently echoes pieces of the client packet, which seems unnecessary with the "encrypted" VN. We could clean that up too if we want, but that should be a separate issue to deal with once this one is done..

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319529514

---

From: Martin Thomson <[email-masked]>
Date: Tue, 01 Aug 2017 19:14:57 -0700

I agree with Jana, adding Server Stateless Retry to that bucket of things that we might re-examine after this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319548608

---

From: Mike Bishop <[email-masked]>
Date: Wed, 02 Aug 2017 22:15:34 +0000 (UTC)

The risk of an encrypted VN packet is that it moves the specifics of encrypting at least that packet into the "can't change between versions" realm.  Do we want to codify something that requires keeping old moldy crypto around just to express what QUIC versions you support that no longer use that crypto?

Whatever we do, Version Negotiation winds up being a one-off -- if we're consistent now, then it's a one-off when we eventually change.  If we don't encrypt, it's a one-off from the start, which might be more honest.  Though I agree the protection against off-path attackers is also interesting.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319814111

---

From: Ryan Hamilton <[email-masked]>
Date: Wed, 02 Aug 2017 15:56:42 -0700

On Wed, Aug 2, 2017 at 3:15 PM, Mike Bishop <[email-masked]>
wrote:

> The risk of an encrypted VN packet is that it moves the specifics of
> encrypting at least that packet into the "can't change between versions"
> realm. Do we want to codify something that requires keeping old moldy
> crypto around just to express what QUIC versions you support that no longer
> use that crypto?
>
​I completely agree with this​ point and think that a minimal VN packet
format is probably best.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319821388

---

From: janaiyengar <[email-masked]>
Date: Wed, 02 Aug 2017 16:07:21 -0700

Mike, Ryan: Are you suggesting that we treat VN as a special snowflake (which it undoubtedly is) and leave it unencrypted with an FNV-128a hash? We have nominal protection against off-path attackers already with a connection ID echo, so that's covered without the encryption.

I am sympathetic to the idea of not wanting to have old crypto sitting around just to handle VN packets. I'd be happy to treat VN packets as special, and leave them unencrypted. I don't think I care enough about bit flips with the VN packet to need an FNV hash for this alone... we'll still have the (weak) UDP checksum to cover that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319823016

---

From: Ryan Hamilton <[email-masked]>
Date: Wed, 02 Aug 2017 23:17:07 +0000 (UTC)

I suggest that it have no encryption and no fnv-128 hash.

On Wed, Aug 2, 2017 at 4:07 PM, janaiyengar <[email-masked]>
wrote:

> Mike, Ryan: Are you suggesting that we treat VN as a special snowflake
> (which it undoubtedly is) and leave it unencrypted with an FNV-128a hash?
> We have nominal protection against off-path attackers already with a
> connection ID echo, so that's covered without the encryption.
>
> I am sympathetic to the idea of not wanting to have old crypto sitting
> around just to handle VN packets. I'd be happy to treat VN packets as
> special, and leave them unencrypted. I don't think I care enough about bit
> flips with the VN packet to need an FNV hash for this alone... we'll still
> have the (weak) UDP checksum to cover that.
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319823016>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ASp6ymfKvman1rx2Ffo8rnM9meurafUgks5sUQEpgaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319824605

---

From: janaiyengar <[email-masked]>
Date: Wed, 02 Aug 2017 16:26:24 -0700

SGTM.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319825959

---

From: ianswett <[email-masked]>
Date: Wed, 02 Aug 2017 23:27:10 +0000 (UTC)

I'm also happy with VN having no encryption and no fnv-128 hash and being a special snowflake.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319826085

---

From: Mike Bishop <[email-masked]>
Date: Wed, 02 Aug 2017 16:47:31 -0700

Likewise, no encryption and no hash.  There are exactly two packet types that are version-independent, which makes them both inherently special snowflakes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319828968

---

From: ianswett <[email-masked]>
Date: Wed, 02 Aug 2017 23:49:51 +0000 (UTC)

The other being stateless(or connection) reset?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319829313

---

From: Mike Bishop <[email-masked]>
Date: Wed, 02 Aug 2017 23:54:38 +0000 (UTC)

Yep.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319829934

---

From: Christian Huitema <[email-masked]>
Date: Thu, 03 Aug 2017 00:21:45 +0000 (UTC)

Since everybody agrees, let's add my vote: no FNV, no encryption for VN.

-- Christian Huitema 

> On Aug 2, 2017, at 4:54 PM, Mike Bishop <[email-masked]> wrote:
> 
> Yep.
> 
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub, or mute the thread.
> 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319833634

---

From: janaiyengar <[email-masked]>
Date: Wed, 02 Aug 2017 19:20:21 -0700

What vote? This is the IETF Christian, we don't vote here.

On Thu, Aug 3, 2017 at 12:21 AM, Christian Huitema <[email-masked]

> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319833634>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AKjg1KR87ZRLXhoNnSeh_ExSWnwgy2Toks5sURKYgaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319849568

---

From: Christian Huitema <[email-masked]>
Date: Thu, 03 Aug 2017 02:27:48 +0000 (UTC)

Jana, do you realize that right now I am finishing a nice bottle of wine, in an island in which I just moored my boat? So yes of course I can pretend to vote!

-- Christian Huitema 

> On Aug 2, 2017, at 7:20 PM, janaiyengar <[email-masked]> wrote:
> 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319850540

---

From: Martin Thomson <[email-masked]>
Date: Thu, 03 Aug 2017 02:32:31 +0000 (UTC)

We still need proof that the VN packet didn't come from off-path.  How should we do that?  We currently echo the header, is that still the right answer?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319851144

---

From: janaiyengar <[email-masked]>
Date: Wed, 02 Aug 2017 19:34:38 -0700

That was my thinking. The protection is as good as the packet encrypted with the connection ID, since the information required to generate the VN is the same in both cases.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319851408

---

From: Ryan Hamilton <[email-masked]>
Date: Thu, 03 Aug 2017 02:57:12 +0000 (UTC)

Agreed. Echoing the connection id seems to provide sufficient entropy to
defend against off-path attackers.

On Wed, Aug 2, 2017 at 7:34 PM, janaiyengar <[email-masked]>
wrote:

> That was my thinking. The protection is as good as the packet encrypted
> with the connection ID, since the information required to generate the VN
> is the same in both cases.
>
> —
> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319851408>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ASp6yl2Lr-8KHUakdZ49tqGUtdBhlPk4ks5sUTG-gaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319854352

---

From: Ryan Hamilton <[email-masked]>
Date: Wed, 02 Aug 2017 19:58:07 -0700

On Wed, Aug 2, 2017 at 7:27 PM, Christian Huitema <[email-masked]>
wrote:

> Jana, do you realize that right now I am finishing a nice bottle of wine,
> in an island in which I just moored my boat? So yes of course I can pretend
> to vote!
>

​I vote that we have the next interim on Christian's boat moored at his
island!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319854466

---

From: janaiyengar <[email-masked]>
Date: Wed, 02 Aug 2017 20:00:40 -0700

I believe Christian isn't too far from Seattle...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-319854799

---

From: ekr <[email-masked]>
Date: Thu, 03 Aug 2017 15:52:39 +0000 (UTC)

But now this is the only thing with some special snowflake anti-injection.
I don't see how that makes things better.

On Wed, Aug 2, 2017 at 7:57 PM, Ryan Hamilton <[email-masked]>
wrote:

> > <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319851408
> >,
> > or mute the thread
> > <https://github.com/notifications/unsubscribe-auth/ASp6yl2Lr-
> 8KHUakdZ49tqGUtdBhlPk4ks5sUTG-gaJpZM4OfFhh>
>
> > .
> >
>
> —
> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319854352>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABD1oRI2adgeAAd4bq4m3CijJmmlabgGks5sUTcHgaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-320010951

---

From: janaiyengar <[email-masked]>
Date: Thu, 03 Aug 2017 17:34:31 -0700

As Mike pointed out, VN and Stateless Reset are special snowflakes, no
matter what. The point is that since whatever we do now with them is going
to become stale sooner or later, leaving it as plaintext seems like the
cleanest approach. That makes sense to me, especially since there's no
additional protection that you get for encrypting them with a forever-fixed
key.

On Thu, Aug 3, 2017 at 3:52 PM, ekr <[email-masked]> wrote:

> > <https://github.com/quicwg/base-drafts/issues/693#issuecomment-319854352
> >,
> > or mute the thread
> > <https://github.com/notifications/unsubscribe-auth/
> ABD1oRI2adgeAAd4bq4m3CijJmmlabgGks5sUTcHgaJpZM4OfFhh>
> > .
> >
>
> —
> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-320010951>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AKjg1FDaaPr7OVpcDH9U1b0tGDo5LKYRks5sUezGgaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-320125396

---

From: ekr <[email-masked]>
Date: Thu, 03 Aug 2017 18:42:02 -0700

I think it's valuable to have a consistent set of defenses that are easy to
reason about.

However, it seems that we have consensus to do this for all packets other
than VN and Stateless Reset, and VN doesn't have any integrity check at all
now. So why don't I send a PR that does this for the other packets and then
we can discuss VN in Seattle?

On Thu, Aug 3, 2017 at 5:34 PM, janaiyengar <[email-masked]>
wrote:

> > > > with the connection ID, since the information required to generate
> the
> > VN
> > <https://github.com/quicwg/base-drafts/issues/693#issuecomment-320010951
> >,
> > or mute the thread
> AKjg1FDaaPr7OVpcDH9U1b0tGDo5LKYRks5sUezGgaJpZM4OfFhh>
>
> > .
> >
>
> —
> <https://github.com/quicwg/base-drafts/issues/693#issuecomment-320125396>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABD1oQWsZvGLuMCKTAF6k9E48X5mBEcAks5sUmcVgaJpZM4OfFhh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-320133947

---

From: janaiyengar <[email-masked]>
Date: Thu, 10 Aug 2017 00:28:40 +0000 (UTC)

Sorry - I thought I had responded to this, but I dropped it. Yes, your plan SGTM.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/693#issuecomment-321417213