Subject: Re: [quicwg/base-drafts] State CS-PRNG requirements (#4318)

From: Florentin <[email-masked]>
Date: Sun, 01 Nov 2020 07:27:38 -0800

@frochet commented on this pull request.

> @@ -1991,6 +1991,16 @@ New QUIC versions SHOULD define a new salt value used in calculating initial
 secrets.

+## Randomness
+
+TLS relies on a cryptographically secure pseudorandom number generator
+(CSPRNG) {{!RFC4086}} to produce random or unpredictable values. In addition
+to the uses in TLS, a source of unpredictable values is used in QUIC for a
+variety of protocol elements, including stateless reset messages, stateless
+reset tokens, and PATH_CHALLENGE frames. An endpoint that employs a weak
+CSPRNG forfeits many of the security properties that QUIC provides.

Yep. Agree with @ekr ; the spec should be less opaque on this matter. @martinthomson mentionned RFC 8937 in the linked issue , which I think would be great to mention in the QUIC-transport draft, as in the QUIC-tls one.

I would be happy to suggest a pull request to briefly explain the concern and connect it to the recent efforts in Post-Snowden crypto research  (rfc 8937 and linked papers). I think we somewhat need the Security Considerations section to connect the implementers with these research security questions currently being undertaken.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#discussion_r515635427

---

From: Martin Thomson <[email-masked]>
Date: Sun, 01 Nov 2020 13:56:22 -0800

@martinthomson commented on this pull request.

 secrets.

+## Randomness
+

There are cases where the CSPRNG is used and cases where a PRF or PRP is better (but a CSPRNG is acceptable, but maybe less efficient because it means remembering).  I wanted to avoid being concrete because this is an implementation choice often.  A recommendation in this case would be bad because a PRF/PRP is often a better choice.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#discussion_r515677214

---

From: ekr <[email-masked]>
Date: Sun, 01 Nov 2020 14:06:58 -0800

@ekr commented on this pull request.

 secrets.

+## Randomness
+

I agree with your point that some of these could be either generated with a PRF/PRP or a PRNG, but I think that this text simultaneously says too much and too little, because (for instance) you could have a strong PRNG and a weak PRF and a lot of these mechanisms would be weak. Constrariwise, you could have a weak PRNG used for QUIC but use a PRF for most of these and then you would be OK for those as long as you had a strong key.

So, I think I would say less:
"QUIC depends on the ability to generate secure random numbers, both directly for protocol values such as the connection ID, and transitively via TLS. See {{!RFC4086}} for guidance on secure random number generation."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#discussion_r515678358

---

From: Martin Thomson <[email-masked]>
Date: Sun, 01 Nov 2020 14:38:47 -0800

secrets.

+## Randomness
+

WFM, thanks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#discussion_r515681891

---

From: Martin Thomson <[email-masked]>
Date: Sun, 01 Nov 2020 14:42:19 -0800

@martinthomson pushed 1 commit.

bea58a02718b81168ef48380799bbf49c21fc3d4  Less is best

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318/files/d844edc09eaa733b142237056ed4a3fecf340e1c..bea58a02718b81168ef48380799bbf49c21fc3d4

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 03 Nov 2020 16:13:24 -0800

@janaiyengar commented on this pull request.

> @@ -1991,6 +1991,13 @@ New QUIC versions SHOULD define a new salt value used in calculating initial
 secrets.

+## Randomness
+
+QUIC depends on the ability to generate secure random numbers, both directly for

```suggestion
QUIC depends on the endpoints' ability to generate secure random numbers, both directly for
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-522962794

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 03 Nov 2020 16:19:12 -0800

@janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-522964652

---

From: Martin Thomson <[email-masked]>
Date: Tue, 03 Nov 2020 16:20:11 -0800

fcc3f7de8b2c86b232a21e66bec0d0ac15cfc386  Who

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318/files/bea58a02718b81168ef48380799bbf49c21fc3d4..fcc3f7de8b2c86b232a21e66bec0d0ac15cfc386

---

From: Mike Bishop <[email-masked]>
Date: Tue, 03 Nov 2020 16:21:51 -0800

@MikeBishop commented on this pull request.

 secrets.

+## Randomness
+
+QUIC depends on endpoint being able to generate secure random numbers, both

```suggestion
QUIC depends on endpoints being able to generate secure random numbers, both
```
Plural, again.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#pullrequestreview-522965490

---

From: Martin Thomson <[email-masked]>
Date: Tue, 03 Nov 2020 16:22:43 -0800

ae45b3bad5eacffa3b02ed18ae1e7749a9920b23  plural

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318/files/fcc3f7de8b2c86b232a21e66bec0d0ac15cfc386..ae45b3bad5eacffa3b02ed18ae1e7749a9920b23

---

From: Martin Thomson <[email-masked]>
Date: Tue, 03 Nov 2020 16:33:37 -0800

Merged #4318 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4318#event-3955324976