Subject: [quicwg/base-drafts] AEAD all packets. Fixed #693, Fixes #840. (#844)

From: ekr <[email-masked]>
Date: Mon, 09 Oct 2017 19:07:56 +0000 (UTC)

This makes the change we discussed in Seattle where all Cleartext
packets are encrypted with AES-GCM using a key derived from the
client connection ID and a random per-version value.

Note: I generated this value using randomness.org.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/844

-- Commit Summary --

  * AEAD all packets. Fixed #693, Fixes #840.

-- File Changes --

    M draft-ietf-quic-tls.md (100)
    M draft-ietf-quic-transport.md (16)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/844.patch
https://github.com/quicwg/base-drafts/pull/844.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/844

---

From: Christian Huitema <[email-masked]>
Date: Mon, 09 Oct 2017 12:52:27 -0700

huitema approved this pull request.

Non trivial code change, we will need to decide whether it is in scope for Singapore interop. But otherwise, I like it. It will fix the corner cases described in issue #843.

> @@ -758,8 +785,11 @@ used for QUIC packet protection is AEAD that is negotiated for use with the TLS
 connection.  For example, if TLS is using the TLS_AES_128_GCM_SHA256, the
 AEAD_AES_128_GCM function is used.
 
-Regular QUIC packets are protected by an AEAD algorithm {{!RFC5116}}.  Version
-negotiation and public reset packets are not protected.
+All QUIC packets other than version negotiation and public reset packets are
+protected with an AEAD algorithm {{!RFC5116}}. Cleartext packets are protected
+with the AEAD_AES_128_GCM and a key derived from the client's connection ID.
+This provides protection against off-path attackers and robustness against
+QUIC version unaware middleboxes, but not against on-path attackers.

I assume that there will be at some point a request to support "QUIC for IOT" and use AES 128 with CCM 8. But we are not there yet, and the IOT folks would just have to create their own version...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/844#pullrequestreview-68089666

---

From: janaiyengar <[email-masked]>
Date: Mon, 09 Oct 2017 15:51:58 -0700

janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/844#pullrequestreview-68128726

---

From: ekr <[email-masked]>
Date: Mon, 09 Oct 2017 16:59:01 -0700

@ekr pushed 1 commit.

cf60548  Update salt. This salt isn't random but rather is the git hash of

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/844/files/a0c571b42e22bdbf2f8e49f9fec03c2be6816ab5..cf605489cedb96ccc796ba5735d132e81b5e56c4

---

From: Martin Thomson <[email-masked]>
Date: Tue, 10 Oct 2017 00:02:42 +0000 (UTC)

Merged #844.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/844#event-1285102522

---

From: MikkelFJ <[email-masked]>
Date: Tue, 10 Oct 2017 00:28:42 -0700

Why the case inconsistency in HKDF "QUIC client cleartext Secret" and ditto server?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/844#issuecomment-335385586