Subject: [quicwg/base-drafts] Add an appendix containing test vectors for "Initial". (#1573)

From: Rui Paulo <[email-masked]>
Date: Mon, 16 Jul 2018 21:55:32 -0700

I'm also working on a PNE appendix.

ping @ekr @huitema 
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1573

-- Commit Summary --

  * Add an appendix containing test vectors for "Initial".

-- File Changes --

    M draft-ietf-quic-tls.md (71)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1573.patch
https://github.com/quicwg/base-drafts/pull/1573.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573

---

From: Masaori Koshiba <[email-masked]>
Date: Thu, 19 Jul 2018 20:30:03 -0700

I tried @ekr's test vector on the list and this test vector. My code passed with ekr's test vector, but failed with this test vector.
I got below values. ("initial secret" is same, but others are not same)
```
initial secret : a572b0245af1eddf5c61c6e3f7f9304ca66bfb4caaf76567d5cb8dd1dc4e820b

client in secret: 9f536457f32a1e0ae864bcb3caf1235110630e1d1fb33835bd054170f99bf7dc
key: f2928f2614ad6c20b9bd008e9c89631c
iv: ab950b0198637978cf44aab9
pn: 68c3f64e2d6634412b8e3294628d76f1

server in secret: b087dcd7478dda8a858fbf3d605c888586c0a3a9875423ad4f114f0ba38e5a2e
key: f56817d0fc595cfc0a2b0bcfb18735ec
iv: 3205035a3c937c902ee4f4d6
pn: a313c86d1373ecbccb3294b14974226c
```

I doubt that there is a bug around `HKDF-Expand-Label` implementation. Because the "info" parameter of `HKDF-Expand` is changed in draft-13. If understand correctly, it's `HkdfLabel` (defined in TLS 1.3) and it has `context<0..255>` field. Without the context field, I got exact same values of this test vector.

QUIC draft-12
```
struct {
    uint16 length = Length;
    opaque label<6..255> = "QUIC " + Label;
} QhkdfExpandInfo;
```

TLS 1.3 (QUIC draft-13)
```
struct {
    uint16 length = Length;
    opaque label<7..255> = "tls13 " + Label;
    opaque context<0..255> = Context;
} HkdfLabel;
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573#issuecomment-406478811

---

From: Rui Paulo <[email-masked]>
Date: Fri, 20 Jul 2018 04:11:46 +0000 (UTC)

That makes sense, thanks for testing.  I can try to get @ekr's vectors into this PR and include the PNE vectors

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573#issuecomment-406483849

---

From: Christian Huitema <[email-masked]>
Date: Wed, 25 Jul 2018 18:21:31 -0700

huitema commented on this pull request.

> +  f2 41 f2 57 2e fe ee 53 ca 69 0c e5 b2 85 ab 34
+  e9 39 e8 fe 98 d7 14 6b b9 fc 78 e9 9a 1b 41 ab
+~~~
+
+Using this secret, we get the following keys (16 bytes) and
+initialization vector (12 bytes):
+
+~~~
+  key:     99 ff fd 2c 3e 4a cd ae 3d 32 02 1c 75 38 86 c0
+
+  pn key:  14 c2 70 2b 54 48 80 d3 9d ab d7 dd c8 eb cd 9a
+
+  IV:      27 92 24 e5 85 fd 84 e9 e0 70 ea 9a
+~~~
+
+

Yes, having something like that in the spec would be useful. We need an independent verification before publishing these values.

Also, having the PN key is fine, but we probably need a complete packet example to ensure that the nonce is properly extracted and the PN properly decrypted.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573#pullrequestreview-140552300

---

From: Christian Huitema <[email-masked]>
Date: Wed, 25 Jul 2018 18:51:28 -0700

In fact, I think that it would be better to start with the test vector in EKR's message "PNE Test Vector" sent on the quic list on 7/18/2018.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573#discussion_r205310858

---

From: Rui Paulo <[email-masked]>
Date: Sun, 29 Jul 2018 21:33:18 -0700

rpaulo commented on this pull request.

@huitema my objective was to have the PN key in this section and then use it for PNE but this PR was just for initial test vectors.  I agree we need independent verification before we publish.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1573#discussion_r206012942