Subject: [quicwg/base-drafts] 2417e9: Define an anti-forgery limit

From: Martin Thomson <[email-masked]>
Date: Thu, 30 Apr 2020 22:58:26 -0700

Branch: refs/heads/forgery-limit
  Home:   https://github.com/quicwg/base-drafts
  Commit: 2417e9d953bdae559dd0b2c74406da98dc75c1e1
      https://github.com/quicwg/base-drafts/commit/2417e9d953bdae559dd0b2c74406da98dc75c1e1
  Author: Martin Thomson <[email-masked]>
  Date:   2020-04-29 (Wed, 29 Apr 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Define an anti-forgery limit

This defines a limit on the number of packets that can fail
authentication before you have to use new keys.

There is a big hole here in that AES-CCM (that is, the AEAD based on
CBC-MAC) is currently permitted, but we have no analysis to support
either the confidentiality limits in TLS 1.3 or the integrity limits in
this document.  It is probably OK, but that is not the standard we apply
here.

So this might have to remain open until we get some sort of resolution
on that issue.  My initial opinion is to cut CCM from the draft
until/unless an analysis is produced.

Closes #3619.