Subject: [quicwg/base-drafts] 2417e9: Define an anti-forgery limit

From: Martin Thomson <[email-masked]>
Date: Tue, 09 Jun 2020 00:21:18 -0700

Branch: refs/heads/master
  Home:   https://github.com/quicwg/base-drafts
  Commit: 2417e9d953bdae559dd0b2c74406da98dc75c1e1
      https://github.com/quicwg/base-drafts/commit/2417e9d953bdae559dd0b2c74406da98dc75c1e1
  Author: Martin Thomson <[email-masked]>
  Date:   2020-04-29 (Wed, 29 Apr 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Define an anti-forgery limit

This defines a limit on the number of packets that can fail
authentication before you have to use new keys.

There is a big hole here in that AES-CCM (that is, the AEAD based on
CBC-MAC) is currently permitted, but we have no analysis to support
either the confidentiality limits in TLS 1.3 or the integrity limits in
this document.  It is probably OK, but that is not the standard we apply
here.

So this might have to remain open until we get some sort of resolution
on that issue.  My initial opinion is to cut CCM from the draft
until/unless an analysis is produced.

Closes #3619.

  Commit: 4b2f0cf43f98a5b8f80e258e6f4de369e9ac8856
      https://github.com/quicwg/base-drafts/commit/4b2f0cf43f98a5b8f80e258e6f4de369e9ac8856
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-01 (Fri, 01 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Update link

  Commit: f94409a03ddd7a92cf1c1388e036a3eecf896853
      https://github.com/quicwg/base-drafts/commit/f94409a03ddd7a92cf1c1388e036a3eecf896853
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-01 (Fri, 01 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Keep CCM

  Commit: a81e74f3a94c44735f38a943d8ad242d6e5adbed
      https://github.com/quicwg/base-drafts/commit/a81e74f3a94c44735f38a943d8ad242d6e5adbed
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-01 (Fri, 01 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Improve description of 'l'

  Commit: 5efe1df7db38536d6b9e2153e5ecb52dacb1105a
      https://github.com/quicwg/base-drafts/commit/5efe1df7db38536d6b9e2153e5ecb52dacb1105a
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-01 (Fri, 01 May 2020)

  Changed paths:
    M draft-ietf-quic-http.md
    M draft-ietf-quic-qpack.md
    M draft-ietf-quic-recovery.md
    M draft-ietf-quic-tls.md
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Merge branch 'master' into forgery-limit

  Commit: acb7b227f19ac7572efb987e60f8e494e1301e32
      https://github.com/quicwg/base-drafts/commit/acb7b227f19ac7572efb987e60f8e494e1301e32
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-07 (Thu, 07 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Basic editing

Co-authored-by: ianswett <[email-masked]>

  Commit: 7d982461c409323b5a2ba2363441c09f3d763832
      https://github.com/quicwg/base-drafts/commit/7d982461c409323b5a2ba2363441c09f3d763832
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Grammah

Co-authored-by: Lucas Pardue <[email-masked]>

  Commit: d5613bc37a4a89238782c0743c64f541c810f54a
      https://github.com/quicwg/base-drafts/commit/d5613bc37a4a89238782c0743c64f541c810f54a
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Editorial comments, reorder

  Commit: 9da9774ddd3638a4f85faf29893495b5855fcbe9
      https://github.com/quicwg/base-drafts/commit/9da9774ddd3638a4f85faf29893495b5855fcbe9
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Editorial improvement

  Commit: cdf655307293ebf7be598849ccdad0f41ce32e11
      https://github.com/quicwg/base-drafts/commit/cdf655307293ebf7be598849ccdad0f41ce32e11
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Math is hard, halve the numbers again

Based on input from @chris-wood, it appears as though the length
calculation was off.

Of course, the length calculation is off anyway, because 2^10 is
arbitrary and doesn't match the expected packet size. But as long as
we're being arbitrary, we can at least be *consistently* arbitrary.

  Commit: 7d4f2ac708582bd6b60d00586d177af41867263a
      https://github.com/quicwg/base-drafts/commit/7d4f2ac708582bd6b60d00586d177af41867263a
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Missed one

Co-authored-by: Felix Günther <[email-masked]>

  Commit: f756508d497d4111c40f0f2523b90d1cd5f91abc
      https://github.com/quicwg/base-drafts/commit/f756508d497d4111c40f0f2523b90d1cd5f91abc
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-08 (Fri, 08 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Explain how we got the 2l value

  Commit: 2eb8646ec7863d97336e7f8e1391391db6d57e24
      https://github.com/quicwg/base-drafts/commit/2eb8646ec7863d97336e7f8e1391391db6d57e24
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-11 (Mon, 11 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Some code review suggestions

Co-authored-by: Christopher Wood <[email-masked]>
Co-authored-by: Felix Günther <[email-masked]>

  Commit: 7958c9f2ae14aaf59ce3cc39817173cc65422dc5
      https://github.com/quicwg/base-drafts/commit/7958c9f2ae14aaf59ce3cc39817173cc65422dc5
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-11 (Mon, 11 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Reflow

  Commit: ce9fde0b69b18db153239177fe1fe5e4655b295d
      https://github.com/quicwg/base-drafts/commit/ce9fde0b69b18db153239177fe1fe5e4655b295d
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-15 (Fri, 15 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Limits are per key

  Commit: 05b02df1e77c959c0dba467baed39e525f2a4ee8
      https://github.com/quicwg/base-drafts/commit/05b02df1e77c959c0dba467baed39e525f2a4ee8
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-22 (Fri, 22 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Stop using the keys, not close

Only require closing the connection if you can't update.

If you hit this limit, you can send a key update.  You won't be able to
read any packets until your peer reads that key update though.  This
manifests as a bunch of packet loss, because you threw out keys.  So you
do end up sending a bunch of packets into the dark in the hopes that one
will get through.

Of course, you can't always update, so you have to close then.

  Commit: bfc409bb529d6a248f4ed20cac3c3d1d204a75ae
      https://github.com/quicwg/base-drafts/commit/bfc409bb529d6a248f4ed20cac3c3d1d204a75ae
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-22 (Fri, 22 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Forgeries likely exhaust TWO keys

Closes #3662.

  Commit: 874036ba9762c1cddaaf54e2dcd43d4d80297161
      https://github.com/quicwg/base-drafts/commit/874036ba9762c1cddaaf54e2dcd43d4d80297161
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-22 (Fri, 22 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  plural

  Commit: 3a1f14b85b5528cf230251a6924f5d0b5581859d
      https://github.com/quicwg/base-drafts/commit/3a1f14b85b5528cf230251a6924f5d0b5581859d
  Author: Martin Thomson <[email-masked]>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Merge pull request #3686 from quicwg/forgeries-and-updates

Forgeries likely exhaust TWO keys

  Commit: f0d856cd4d6250e910c89029ea6f7e7c09ceb367
      https://github.com/quicwg/base-drafts/commit/f0d856cd4d6250e910c89029ea6f7e7c09ceb367
  Author: Martin Thomson <[email-masked]>
  Date:   2020-06-09 (Tue, 09 Jun 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Merge pull request #3620 from quicwg/forgery-limit

Define an anti-forgery limit

Compare: https://github.com/quicwg/base-drafts/compare/18becf27d355...f0d856cd4d62