Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update AEAD limits for larger packets #4175

Merged
merged 4 commits into from Oct 15, 2020
Merged

Update AEAD limits for larger packets #4175

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ef94ae1
Update AEAD limits for larger packets
martinthomson Oct 2, 2020
551184a
Grammaaaaaa!
martinthomson Oct 8, 2020
5280b95
Code review tweaks
martinthomson Oct 15, 2020
feff732
Wrap
martinthomson Oct 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 7 additions & 6 deletions draft-ietf-quic-tls.md
View file
Open in desktop
Expand Up @@ -2308,10 +2308,11 @@ o:

The analyses that follow rely on a count of the number of block operations
involved in producing each message. This analysis is performed for packets of
size up to 2^11 (l = 2^7) and 2^16 (l = 2^12). A size of 2^11 is expected to be a
limit that matches common deployment patterns, whereas the 2^16 is the maximum
size up to 2^11 (l = 2^7) and 2^16 (l = 2^12). A size of 2^11 is expected to be
a limit that matches common deployment patterns, whereas the 2^16 is the maximum
possible size of a QUIC packet. Only endpoints that strictly limit packet size
can use the larger confidentiality and integrity limits that are derived using the smaller packet size.
can use the larger confidentiality and integrity limits that are derived using
the smaller packet size.

For AEAD_AES_128_GCM and AEAD_AES_256_GCM, the message length (l) is the length
of the associated data in blocks plus the length of the plaintext in blocks.
Expand Down Expand Up @@ -2385,9 +2386,9 @@ significant effect on the result. This produces the following approximation:
v <= 2^64 / l
~~~

Endpoints that do not attempt to remove protection from packets larger than
2^11 bytes can attempt to remove protection from at most 2^57 packets. Endpoints
that do not restrict the size of processed packets can attempt to remove protection
Endpoints that do not attempt to remove protection from packets larger than 2^11
bytes can attempt to remove protection from at most 2^57 packets. Endpoints that
do not restrict the size of processed packets can attempt to remove protection
from at most 2^52 packets.

For AEAD_AES_256_GCM, the same term dominates, but the larger value of k
Expand Down