Subject: [quicwg/base-drafts] Reference "Nonces are Noticed" in the header protection analysis section (#3031)

From: Christopher Wood <[email-masked]>
Date: Fri, 13 Sep 2019 14:25:29 -0700

This paper studies several &quot;nonce hiding&quot; transformations, of which the QUIC
header protection algorithm is one. This change replaces the old analysis
text with something a bit more crisp.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3031

-- Commit Summary --

  * Reference &quot;Nonces are Noticed&quot; in the header protection analysis section.

-- File Changes --

    M draft-ietf-quic-tls.md (42)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3031.patch
https://github.com/quicwg/base-drafts/pull/3031.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031

---

From: MikkelFJ <[email-masked]>
Date: Fri, 13 Sep 2019 22:45:10 -0700

mikkelfj commented on this pull request.

 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the

AE2 security is not an easily digestible term on its own. What is the objective, where is it defined?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#pullrequestreview-288308613

---

From: Christopher Wood <[email-masked]>
Date: Sat, 14 Sep 2019 06:21:11 -0700

chris-wood commented on this pull request.

 ~~~

It’s defined in the referenced paper. I thought it best to simply point readers in that direction if they want the details, rather try and pull it out here. (We didn’t previously define IND-CPA security, for example.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324424299

---

From: Martin Thomson <[email-masked]>
Date: Sun, 15 Sep 2019 22:23:51 -0700

martinthomson commented on this pull request.

I like the Nonces paper.  That validates a lot of what we have previously only theorized.

> -    date: 2014-11-06
-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20
+    target: "https://web.cs.ucdavis.edu/~rogaway/papers/ad.pdf"
+
+  NAN:
+    title: "Nonces are Noticed: AEAD Revisited"
+    author:
+      - ins: M. Bellare
+      - ins: R. Ng
+      - ins: B. Tackmann
+    date: 2019-06-01
+    target: https://eprint.iacr.org/2019/624
+    seriesinfo: Advances in Cryptology – CRYPTO 2019, pages 235-265

So this is not the same paper (the link references a full paper of which the CRYPTO 2019 piece was just a preview).  Not sure how to thread that.

Will the CRYPTO version have a DOI that we can use?

>      author:
-      - ins: J. Katz
-      - ins: Y. Lindell
-    date: 2014-11-06
-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20
+    target: "https://web.cs.ucdavis.edu/~rogaway/papers/ad.pdf"

This has the same property as the one below, except that you don't cite the proceedings:

> [21] P. Rogaway. Authenticated-encryption with associated-data.Ninth ACM Conference onComputer and Communications Security(CCS-9). ACM Press, 2002. Proceedings version of this paper

 ~~~

This isn't an assumption, it's a property we provide.

```suggestion
As `hp_key` is distinct from the packet protection key, this construction
```

 ~~~

I would expand this to cite {{NAN}} again.

```suggestion
(HN1) achieves AE2 security as defined in {{NAN}} and therefore guarantees privacy of `field`, the
```

 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is

I'm not sure that the distinction this middle sentence makes is relevant.  The definition of HN1 only depends on F being a PRF.  The existing header protection functions use a PRF.  We should probably say something about what it takes to define a new header protection scheme somewhere though.

 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is
+pseudorandom {{DefnAEAD}}, this achieves the properties desired from a PRF.

I don't think that you need to cite Rogaway's paper here.  We're not relying on the properties of an AEAD (the HN1 construction was, so it might be a little misleading to skew that direction).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#pullrequestreview-288407951

---

From: Martin Thomson <[email-masked]>
Date: Sun, 15 Sep 2019 22:24:08 -0700

-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20

I'll answer my own question: http://dx.doi.org/10.1007/978-3-030-26948-7_9

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324513043

---

From: MikkelFJ <[email-masked]>
Date: Sun, 15 Sep 2019 22:31:45 -0700

~~~

Even with citing, AE2 is not searchable. It is probably AE-scheme II, but I have only skimmed the paper.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324514087

---

From: Martin Thomson <[email-masked]>
Date: Sun, 15 Sep 2019 22:50:46 -0700

~~~

> We  give  a  modified  syntax  for  nonce-based encryption, called NBE2, in which decryption does not get the nonce, a corresponding framework of security definitions called AE2 that guarantee nonce privacy in addition to authenticity and message privacy, and simple ways to turn NBE1 AE1-secure schemes into NBE2 AE2-secure schemes.

This is in the introduction of the paper, under "Contributions in brief."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324516322

---

From: MikkelFJ <[email-masked]>
Date: Sun, 15 Sep 2019 22:54:45 -0700

~~~

Uh sorry, I was locked on to Rogaway's paper.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324516877

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:34:03 -0700

@chris-wood pushed 1 commit.

55e1cf951bd5ed47925cb01ea37eae54757fa923  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031/files/be8f6e1438d4a4cd79081898688fb3ed3f640ed4..55e1cf951bd5ed47925cb01ea37eae54757fa923

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:34:47 -0700

-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20

I chose the ePrint copy since it's more likely to stay up to date. I can swap in a reference to the CRYPTO version, though!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324677694

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:34:57 -0700

-      - ins: J. Katz
-      - ins: Y. Lindell
-    date: 2014-11-06
-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20

Will fix!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324677804

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:35:17 -0700

4e8c028d25b04a895507db826491ea38a2cd680f  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031/files/55e1cf951bd5ed47925cb01ea37eae54757fa923..4e8c028d25b04a895507db826491ea38a2cd680f

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:36:07 -0700

~~~

I used this text in the off chance that we decide to change the scheme again. Using what's currently specified is probably better though. Thanks for the suggestion!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324678461

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:39:29 -0700

~~~

I think the distinction is important because AEADs are (depending on one's definition) not PRFs. 

> We should probably say something about what it takes to define a new header protection scheme somewhere though.

Hmm, I'm not sure. That's probably best done elsewhere, e.g., a CFRG document, that we then cite. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324680042

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:40:28 -0700

~~~

Rogaway's definition assumes the encrypted output is pseudorandom (per the Adv^PRIV requirement), and that's the property header protection relies on, so I felt it best to cite.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324680607

---

From: Christopher Wood <[email-masked]>
Date: Mon, 16 Sep 2019 06:59:18 -0700

d86243037a40c9a5f4e31fea55bd7f97b83b53bb  Update references. Fix linting issues.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031/files/4e8c028d25b04a895507db826491ea38a2cd680f..d86243037a40c9a5f4e31fea55bd7f97b83b53bb

---

From: Martin Thomson <[email-masked]>
Date: Tue, 17 Sep 2019 18:29:52 -0700

I think that we're still maybe talking past each other.

> @@ -84,7 +85,7 @@ informative:
       - ins: R. Ng
       - ins: B. Tackmann
     date: 2019-06-01
-    target: https://eprint.iacr.org/2019/624
+    target: "http://dx.doi.org/10.1007/978-3-030-26948-7_9"

With a DOI, you can just cite this as: `{{?NAN=DOI.10.1007/978-3-030-26948-7_9}}` and save all that typing.  Same for the above.

> @@ -1440,12 +1441,13 @@ Header protection uses the output of the packet protection AEAD to derive
 
-Assuming hp_key is distinct from the packet protection key, this construction
-(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
-protected packet header. One important distinction between HN1 and the header
-protection construction in this document is that the latter uses an AEAD
-algorithm as the PRF. However, since the encrypted output of an AEAD is
-pseudorandom {{DefnAEAD}}, this achieves the properties desired from a PRF.
+As `hp_key` is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security as defined in {{NAN}} and therefore guarantees
+privacy of `field`, the protected packet header. One important distinction
+between HN1 and the header protection construction in this document is that
+the latter uses an AEAD algorithm as the PRF. However, since the encrypted
+output of an AEAD is pseudorandom {{DefnAEAD}}, this achieves the properties
+desired from a PRF.

This last sentence doesn't wash well for me still.

The reason that we care about the AEAD output being pseudorandom is that this is the way we select the key we use for header protection.  But that is something that the Nonces are Noticed paper should worry about in its proofs.  The important factor for us here is that we are using the HN1 construction properly.  For that, we only need to show that we are using a PRF.  To support that we just need to say that both AES-ECB and ChaCha20 are PRFs.  If that claim needs support, that requires a different paper.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#pullrequestreview-289626822

---

From: Christopher Wood <[email-masked]>
Date: Tue, 17 Sep 2019 18:50:50 -0700

- ins: R. Ng
       - ins: B. Tackmann
     date: 2019-06-01

Awesome! Thanks for that tip.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r325452359

---

From: Christopher Wood <[email-masked]>
Date: Tue, 17 Sep 2019 18:51:42 -0700

Ah, right! I was operating under the assumption that we used AEADs for the mask, but we use the primitives. Since those are PRPs and therefore PRFs, this becomes much simpler. Stay tuned for an update!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r325452531

---

From: MikkelFJ <[email-masked]>
Date: Tue, 17 Sep 2019 22:30:06 -0700

- ins: R. Ng
       - ins: B. Tackmann
     date: 2019-06-01

That link is behind a springer paywall - the former wasn't.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r325487758

---

From: Christopher Wood <[email-masked]>
Date: Wed, 18 Sep 2019 04:30:34 -0700

6040f5f6419fbdbea8b014d318407dc0bb4fd27e  Remove AEAD mask generation with a PRP(=PRF), and update references accordingly.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031/files/d86243037a40c9a5f4e31fea55bd7f97b83b53bb..6040f5f6419fbdbea8b014d318407dc0bb4fd27e

---

From: Christopher Wood <[email-masked]>
Date: Wed, 18 Sep 2019 04:31:42 -0700

- ins: R. Ng
       - ins: B. Tackmann
     date: 2019-06-01

True, yet the DOI is stable. I'm sure folks won't have trouble finding the ePrint version.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r325622335

---

From: Martin Thomson <[email-masked]>
Date: Wed, 18 Sep 2019 04:36:22 -0700

Merged #3031 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#event-2643173607

---

From: Martin Thomson <[email-masked]>
Date: Wed, 18 Sep 2019 04:37:20 -0700

I'm really happy to see good research on this that confirms our intuitions about one of the most important QUIC-specific constructions.  Thanks for doing this Chris.

Are you planning to make a similar contribution to DTLS 1.3?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#issuecomment-532645269

---

From: Christopher Wood <[email-masked]>
Date: Wed, 18 Sep 2019 05:34:51 -0700

> Thanks for doing this Chris.

My pleasure. :-)

> Are you planning to make a similar contribution to DTLS 1.3?

Yep!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#issuecomment-532663717