Subject: [quicwg/base-drafts] State CS-PRNG requirements (#4318)

From: Martin Thomson <[email-masked]>
Date: Thu, 29 Oct 2020 18:23:41 -0700

I&#39;m opposed to saying that values from a PRNG shouldn&#39;t be exposed.  But
we can at least say that we need a good CS-PRNG to get many of the
security properties claimed by the protocol.

Closes #4314.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4318

-- Commit Summary --

  * State CS-PRNG requirements

-- File Changes --

    M draft-ietf-quic-tls.md (10)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4318.patch
https://github.com/quicwg/base-drafts/pull/4318.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318

---

From: Christopher Wood <[email-masked]>
Date: Fri, 30 Oct 2020 07:46:10 -0700

@chris-wood approved this pull request.

> @@ -1991,6 +1991,16 @@ New QUIC versions SHOULD define a new salt value used in calculating initial
 secrets.

+## Randomness
+
+TLS relies on a cryptographically secure pseudorandom number generator
+(CS-PRNG) {{!RFC4086}} to produce random or unpredictable values. In addition

```suggestion
(CSPRNG) {{!RFC4086}} to produce random or unpredictable values. In addition
```

> @@ -1991,6 +1991,16 @@ New QUIC versions SHOULD define a new salt value used in calculating initial
 secrets.

+## Randomness
+
+TLS relies on a cryptographically secure pseudorandom number generator
+(CS-PRNG) {{!RFC4086}} to produce random or unpredictable values. In addition
+to the uses in TLS, a source of unpredictable values is used in QUIC for a
+variety of protocol elements, including stateless reset messages, stateless
+reset tokens, and PATH_CHALLENGE frames. An endpoint that employs a weak
+CS-PRNG forfeits many of the security properties that QUIC provides.

```suggestion
CSPRNG forfeits many of the security properties that QUIC provides.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-520693743

---

From: Martin Thomson <[email-masked]>
Date: Fri, 30 Oct 2020 14:40:59 -0700

@martinthomson pushed 1 commit.

1e3dd94cca61c5ef44311e5cb2c5ca8af3d3570c  dehyphenate

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318/files/9234f63528e54644071a494465b4c96018a55050..1e3dd94cca61c5ef44311e5cb2c5ca8af3d3570c

---

From: Martin Thomson <[email-masked]>
Date: Fri, 30 Oct 2020 14:41:16 -0700

d844edc09eaa733b142237056ed4a3fecf340e1c  dehyphenate

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318/files/1e3dd94cca61c5ef44311e5cb2c5ca8af3d3570c..d844edc09eaa733b142237056ed4a3fecf340e1c

---

From: ekr <[email-masked]>
Date: Fri, 30 Oct 2020 15:03:10 -0700

@ekr commented on this pull request.

 secrets.

+## Randomness
+
+TLS relies on a cryptographically secure pseudorandom number generator
+(CSPRNG) {{!RFC4086}} to produce random or unpredictable values. In addition
+to the uses in TLS, a source of unpredictable values is used in QUIC for a
+variety of protocol elements, including stateless reset messages, stateless
+reset tokens, and PATH_CHALLENGE frames. An endpoint that employs a weak
+CSPRNG forfeits many of the security properties that QUIC provides.

Is there a reason to be this opaque? I would just say that you SHOULD use a CSPRNG for most of these.

Note that some of these actually shouldn't be random, but are generated with a PRG.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-521060374

---

From: Marten Seemann <[email-masked]>
Date: Fri, 30 Oct 2020 21:28:24 -0700

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-521111743