Subject: [quicwg/base-drafts] ChaCha20 header protection sample (#3199)

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Nov 2019 16:22:12 -0800

The sample taken for header protection is interpreted differently in DTLS 1.3.  QUIC uses `counter||nonce`, DTLS 1.3 uses `nonce||counter`.

That difference is likely to cause problems unless we erase it.  It's possible that the DTLS ordering is the right one here, but we should make a conscious decision.

See tlswg/dtls13-spec#109.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 06 Nov 2019 16:45:41 -0800

I do not have a strong opinion here, though I might point out that [RFC 7539 section 2.3](https://tools.ietf.org/html/rfc7539#section-2.3) states:
```
   o  Word 12 is a block counter.  Since each block is 64-byte, a 32-bit
      word is enough for 256 gigabytes of data.

   o  Words 13-15 are a nonce, which should not be repeated for the same
      key.  The 13th word is the first 32 bits of the input nonce taken
      as a little-endian integer, while the 15th word is the last 32
      bits.
```

Retaining this order (i.e. `counter||nonce`) might be helpful to certain implementations.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-550567909

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Nov 2019 16:55:35 -0800

This is what motivated the order that is in QUIC, yes.  But the construction of AES-GCM puts the counter second.  And here I thought that we were free of endianness issues.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-550570164

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 06 Nov 2019 17:27:39 -0800

Though we do not use AES-GCM for header protection. That said, I can see your argument that we tend to favor having the nonce first.

So to me it seems the question is if we should have a generic design for using stream ciphers for header protection, or if we should let each stream cipher have its own.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-550577719

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Nov 2019 17:48:12 -0800

Oh, I'm not arguing for the DTLS approach, only pointing out that it is rational when taken from a certain perspective.  I'd be happy if QUIC didn't need to change.  @davidben tends to favour the QUIC ordering also, FWIW.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-550582411

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Nov 2019 21:47:47 -0800

Closed #3199.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#event-2790214367

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Nov 2019 21:47:47 -0800

OK, it looks like ekr moved DTLS to match.  Closing this with no action.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-552744745

---

From: MikkelFJ <[email-masked]>
Date: Tue, 12 Nov 2019 05:01:55 -0800

How does that work? Is that a future version of DTLS?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-552883629

---

From: Martin Thomson <[email-masked]>
Date: Tue, 12 Nov 2019 13:13:06 -0800

@mikkelfj, this is [DTLS 1.3](https://github.com/tlswg/dtls13-spec).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-553116831

---

From: MikkelFJ <[email-masked]>
Date: Tue, 12 Nov 2019 13:32:29 -0800

@martinthomson thanks

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3199#issuecomment-553124732