Subject: [quicwg/base-drafts] Example of ChaCha20-Poly1305 (#3712)

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 00:35:15 -0700

This uses a packet with a short header because a) we don&#39;t have an example of that already; b) that gives me an opportunity to show what the different key derivations look like, including key updates; and c) this example won&#39;t need to be updated when the draft number changes, or even when the final spec is complete.

I chose the shortest possible packet with the smallest possible payload for this.  Values are taken from neqo, so it&#39;s a little annoying to reproduce.

Assistance in validating the values here would be appreciated.  We already interoperate, so I expect these to work, but a sanity check is always helpful.

Closes #3488.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3712

-- Commit Summary --

  * Example of ChaCha20-Poly1305

-- File Changes --

    M draft-ietf-quic-tls.md (62)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3712.patch
https://github.com/quicwg/base-drafts/pull/3712.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 00:53:32 -0700

@martinthomson pushed 1 commit.

3143f6f3180e8435b73d38d77c207ae6b2cca764  It's more believeable to use HANDSHAKE_DONE

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712/files/ee88574c89796791d66269a9aa6a16eb85b534b1..3143f6f3180e8435b73d38d77c207ae6b2cca764

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jun 2020 01:14:27 -0700

@marten-seemann commented on this pull request.

> +## ChaCha20-Poly1305 Short Header Packet
+
+This example shows some of the steps required to protect a packet with
+a short header.  This example uses AEAD_CHACHA20_POLY1305.
+
+In this example, TLS produces an application write secret from which a server
+uses HKDF-Expand-Label to produce four values: a key, an IV, a header
+protection key, and the secret that will be used after keys are updated (this
+last value is not used further in this example).
+
+~~~
+secret
+    = 9ac312a7f877468ebe69422748ad00a1
+      5443f18203a07d6060f688f30f21632b
+
+key = HKDF-Expand-Label(server_initial_secret, "quic key", _, 32)

This should be `secret` instead of `server_initial_secret` here, right?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#pullrequestreview-422442791

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jun 2020 01:40:59 -0700

> +      73573685608597d0efcb076b0ab7a7a4
+
+ku  = HKDF-Expand-Label(server_initial_secret, "quic ku", _, 32)
+    = 1223504755036d556342ee9361d25342
+      1a826c9ecdf3c7148684b36b714881f9
+~~~
+
+The following shows the steps involved in protecting a minimal packet with an
+empty Destination Connection ID. This packet contains a single HANDSHAKE_DONE
+frame (that is, a payload of just 0x1e) and has a packet number of 0. In this
+example, a packet number of length 3 is used to avoid having to pad the payload
+of the packet; PADDING frames would be needed if the packet number is encoded
+on fewer octets.
+
+~~~
+pn                 = 0

I'd prefer to use a non-zero value here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#pullrequestreview-422463731

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jun 2020 01:47:14 -0700

I added a test case to quic-go using the values from this PR, and the test passes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-637391068

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 01:58:35 -0700

@martinthomson commented on this pull request.

+

Easier said than done.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#discussion_r433725156

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 01:59:07 -0700

1d81fce14c2bff5e4c576c78a1795192460d5539  Wrong secret

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712/files/b31eb923fb039d69f3d1e0893be1ac1c87585161..1d81fce14c2bff5e4c576c78a1795192460d5539

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jun 2020 02:03:41 -0700

+

Why's that? What is special about 0?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#discussion_r433728165

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 02:38:19 -0700

b485b7922ff6f5ed61613e93a96c76afdf060528  Generate values with the script instead

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712/files/1d81fce14c2bff5e4c576c78a1795192460d5539..b485b7922ff6f5ed61613e93a96c76afdf060528

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 02:39:13 -0700

OK, I have hacked something together.  This is completely untested so far.  I'm going to try to feed this into our implementation somehow.  That's non-trivial, but we'll see.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-637421932

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 03:11:43 -0700

> +      73573685608597d0efcb076b0ab7a7a4
+
+ku  = HKDF-Expand-Label(secret, "quic ku", _, 32)
+    = 1223504755036d556342ee9361d25342
+      1a826c9ecdf3c7148684b36b714881f9
+~~~
+
+The following shows the steps involved in protecting a minimal packet with an
+empty Destination Connection ID. This packet contains a single PING frame (that
+is, a payload of just 0x01) and has a packet number of 654360564. In this
+example, using a packet number of length 3 (that is, 49140 is encoded) avoids
+having to pad the payload of the packet; PADDING frames would be needed if the
+packet number is encoded on fewer octets.
+
+~~~
+pn                 = 654360564 (decimal)

It's hard to believe that this number came out of a random number generator, but that's where it came from.  That `pn & 0xffffff == pn & 0ffff` is also pure chance, but it seems like a useful property to try to use.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#pullrequestreview-422534159

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 03:12:23 -0700

neqo is happy with this sample.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-637439028

---

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jun 2020 03:13:47 -0700

+

This packet was from me reading the logs of our implementation, which sends HANDSHAKE_DONE in packet 0.  But I decided that it might be better to make this reproducible, and it wasn't THAT hard to write some JS.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#discussion_r433768945

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jun 2020 20:03:30 -0700

@martinthomson Thank you for updating this example. I just updated the test-case in quic-go and I can confirm that the values match.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-637924293

---

From: Alessandro Ghedini <[email-masked]>
Date: Thu, 04 Jun 2020 11:58:16 -0700

FWIW, I also added tests to quiche using these vectors and they seem to work.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-639054532

---

From: Martin Thomson <[email-masked]>
Date: Thu, 04 Jun 2020 16:22:04 -0700

That's 3.  Thanks both, I'll take that as sufficient.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#issuecomment-639167384

---

From: Martin Thomson <[email-masked]>
Date: Thu, 04 Jun 2020 16:22:09 -0700

Merged #3712 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3712#event-3409094148