Subject: [quicwg/base-drafts] 5.6 Packet Number Protection is hard to follow (#1387)

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Thu, 24 May 2018 05:09:27 -0700

It is hard to understand TLS 5.6 Packet Number Protection.

More specifically, this text block:

"""
   In sampling the packet ciphertext, the packet number length is
   assumed to be the smaller of the maximum possible packet number
   encoding (4 octets), or the size of the protected packet minus the
   minimum expansion for the AEAD.  For example, the sampled ciphertext
   for a packet with a short header can be determined by:

   "sample_offset = min(1 + connection_id_length + 4, packet_length -
   aead_expansion) sample =
   packet[sample_offset..sample_offset+sample_length] "
"""

It is ambiguous that what packet_length is.  Is it the Packet length field in Long packet header?  But it does not appear in Short header.  Is it the length of (Protected) Payload?  Or the length of QUIC packet?

The text says "the packet number length is ...", but the example seems to be offset to the byte to sample.

It would be also nice to show the example of Long packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1387

---

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Thu, 24 May 2018 07:24:55 -0700

If I assume that packet_length specifies the length of QUIC packet, it looks like packet number cannot be decrypted when compound packet is used.
This is because the packet_length (= the length of QUIC packet) is only known when we know the length of packet number field.  But in order to know the length of packet number field, we have to decrypt it.  In order to decrypt the packet number, we have to know the packet_length.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1387#issuecomment-391734068

---

From: Martin Thomson <[email-masked]>
Date: Mon, 28 May 2018 19:37:03 -0700

Closed #1387 via #1389.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1387#event-1650101013

---

From: Martin Thomson <[email-masked]>
Date: Mon, 28 May 2018 19:38:59 -0700

The issue here is that it is impossible to find the end of the packet because the end of the packet is used to determine what octets to sample for packet number protection, and the length of the packet number is unknown until packet number protection is removed.  This was fixed by including the packet number in the length field.  This will require notes in the change log.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1387#issuecomment-392636952