Subject: [quicwg/base-drafts] Define an anti-forgery limit (#3620)

From: Martin Thomson <[email-masked]>
Date: Thu, 30 Apr 2020 22:59:12 -0700

This defines a limit on the number of packets that can fail
authentication before you have to use new keys.

There is a big hole here in that AES-CCM (that is, the AEAD based on
CBC-MAC) is currently permitted, but we have no analysis to support
either the confidentiality limits in TLS 1.3 or the integrity limits in
this document.  It is probably OK, but that is not the standard we apply
here.

So this might have to remain open until we get some sort of resolution
on that issue.  My initial opinion is to cut CCM from the draft
until/unless an analysis is produced.

Closes #3619.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3620

-- Commit Summary --

  * Define an anti-forgery limit

-- File Changes --

    M draft-ietf-quic-tls.md (32)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3620.patch
https://github.com/quicwg/base-drafts/pull/3620.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3620