Subject: [quicwg/base-drafts] The packet number gap is overspecified (#1034)

From: Christian Huitema <[email-masked]>
Date: Sat, 30 Dec 2017 20:22:16 +0000 (UTC)

The "Packet Number Gap" is currently specified in section 7.7.1.1 of the transport draft. The section correctly states that "In order to avoid linkage, the packet number gap MUST be externally indistinguishable from random." But then, it goes on to present a cryptographic formula:
~~~
Gap = HKDF-Expand-Label(packet_number_secret,
                        "QUIC packet sequence gap", sequence, 4)
~~~
The formula relies on a "packet number secret" derived from the master secret.

This seems seriously over specified. What is exactly the reason to use this derivation, rather than merely drawing a 32 bit random number? Why the complexity of another call to the crypto library, and another secret to maintain in the connection context? Do we expect the receiving end of the connection to verify that the gap has been computed using the proper secret?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1034

---

From: Christian Huitema <[email-masked]>
Date: Sat, 30 Dec 2017 20:31:22 +0000 (UTC)

Also, the current text is hard to follow, due to the use of "sequence number" for both the packet sequence number and the "number of the chosen connection ID in the sequence of new connection ID". I had to read it multiple times to decipher what was actually requested.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1034#issuecomment-354566743

---

From: Christian Huitema <[email-masked]>
Date: Sat, 30 Dec 2017 23:13:41 +0000 (UTC)

Not only is it complicated, it does not even achieve the stated privacy goal. It is unclear from the text if the server also applies the gap, or not. But if it does apply the gap, it will be the same gap as the client, and adversaries can find that to link the old and the new context. And if it does not apply the gap, then adversaries can also link the old and new context...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1034#issuecomment-354573921