Subject: [quicwg/base-drafts] ed9bbf: Update AEAD limits

From: Martin Thomson <[email-masked]>
Date: Sun, 05 Jul 2020 23:58:10 -0700

Branch: refs/heads/aead-limits2
  Home:   https://github.com/quicwg/base-drafts
  Commit: ed9bbfc7a712b67466842abef03932dbf369dc1e
      https://github.com/quicwg/base-drafts/commit/ed9bbfc7a712b67466842abef03932dbf369dc1e
  Author: Martin Thomson <[email-masked]>
  Date:   2020-07-06 (Mon, 06 Jul 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Update AEAD limits

This corrects an arithmetic error in the calculation of the
confidentiality limit for AES-GCM.

It also changes to using a fixed advantage target of 2^-57 for both
confidentiality and integrity.  The inconsistent use of different limits
was making it hard to reason about.  As the overall target is AE
security, the net effect of this is a factor of 2 improvement in
attacker advantage over what is in the TLS analysis, which was
2^-57+2^-60.  This moves to 2^-56 overall, which is cleaner.

In doing so, I discovered that the integrity limits for both AES-GCM and
AES-CCM were being set independent of the confidentiality limits, but
that the confidentiality limits assumed limits on the number of
forgeries.  As a result, the limits on forgeries had to be capped based
on those assumptions.