Skip to content

Commit

Permalink
Simplify more
Browse files Browse the repository at this point in the history
  • Loading branch information
martinthomson committed Sep 6, 2019
1 parent 36609c2 commit b0f00ed
Showing 1 changed file with 11 additions and 6 deletions.
17 changes: 11 additions & 6 deletions draft-ietf-quic-tls.md
Original file line number Diff line number Diff line change
Expand Up @@ -1048,21 +1048,26 @@ When AEAD_CHACHA20_POLY1305 is in use, header protection uses the raw ChaCha20
function as defined in Section 2.4 of {{!CHACHA}}. This uses a 256-bit key and
16 bytes sampled from the packet protection output.

The first 4 bytes of the sampled ciphertext are interpreted as a 32-bit number
in little-endian order and are used as the block count; a ChaCha20
implementation might instead take the 4 bytes as an opaque sequence of bytes.
The remaining 12 bytes are used as the nonce.
The first 4 bytes of the sampled ciphertext are the block counter. A ChaCha20
implementation could take a 32-bit integer in place of a byte sequence, in
which case the byte sequence is interpreted as a little-endian value.

This comment has been minimized.

Copy link
@mikkelfj

mikkelfj Sep 6, 2019

Contributor

Don't you mean the opposite?

implementation could take a byte sequence in place of a 32-bit integer, in

What happened to the suggest change?

This comment has been minimized.

Copy link
@martinthomson

martinthomson Sep 6, 2019

Author Member

I think that this is right. The starting assumption is that the input is a byte sequence (the first sentence).

The second sentence says that if the ChaCha20 implementation expects a 32-bit integer instead, the bytes are read as a little-endian number.

This comment has been minimized.

Copy link
@mikkelfj

mikkelfj Sep 6, 2019

Contributor

I see


The remaining 12 bytes are used as the nonce. A ChaCha20 implementation might
take an array of three 32-bit integers in place of a byte sequence, in which
case the nonce bytes are interpreted as a sequence of 32-bit little-endian
integers.

The encryption mask is produced by invoking ChaCha20 to protect 5 zero bytes. In
pseudocode:

~~~
counter = DecodeLE(sample[0..3])
nonce = sample[4....15]
counter = sample[0..3]
nonce = sample[4..15]
mask = ChaCha20(hp_key, counter, nonce, {0,0,0,0,0})
~~~



## Receiving Protected Packets

Once an endpoint successfully receives a packet with a given packet number, it
Expand Down

0 comments on commit b0f00ed

Please sign in to comment.