Subject: PNE Test Vector

From: Eric Rescorla <[email-masked]>
Date: Wed, 18 Jul 2018 07:11:49 -0700

As discussed in the meeting, here is a test vector for PNE. It's an Initial
packet generated by Kazuho but processed by Minq, with the output being an
edited and annotated version of Minq's logging. Happy to help with more
logging if that helps.

INPUT PACKET
ffff00000d5006b858ec6f80452b0044efa5d8d307c2973fa0d63fd9b03a4e163b990dd778894a9edc8eacfbe4aa6fbf4a22ec7f906b5e8b8ae12e5fcc7924dfeee813842bb2149b805e55895084e8393200bb3fc618af7d08281485d914ce42303f5d772b200508a0c00253e332e36a84f657321ac4c8e2cc8a117e95871f12b1f36be8c4b76fa433dc4d3142e6547f4598bf4b192130aea6fc20da5158b2162b5a899957da05ded5c70907298fd885847f22a1ecb0a814fe0170e23cad20af64f05cc13c74e91824101afdcf5f1532fc2fde936a3a159f76283a26c738f778c76e6ca41fa7f134401d39027fd81de17a8021a9c0aaa9b4478fe5c0647941618f3bee410caf94c248d2a64b5e45845cd77de13a5ed94034d2bc5f457887351993c1ecfa34fd0c658fea3f8086d26808eef976262ecf0ad646b627945511dde83e26609cd5cfd7ed9f6207d76618b44c48bf623bf420dc7c127e5d5f529f083b71a17b17da329bfc38a74bf8cfcf315c7c070b71ebfae3ab351341a767adfdd9e57c738f5de9da53711e886d1472310b917a1c9798e3e9b13c7c74beb8d1b82345bea1349415679a9c64b0433b68c871ae08092a1f6106bc06337cd343866ee8185c03fcf3bb0666453f847905547199414c1e57535747be61cdf6778378f121d68df0181ee9e8d9932c1c593c0f8c0a1af0f5262b86205002dced9ecdaee2d0aa07dd4c14f98571e4bea72f8474f63697043e936ebb2bf9716ed0efbdc13005a75cee3a49babc61b9677764510eb19828df4e10fb38b79a1efbf04cc2d571949d5403f797361743dcc5e3bf3b4396f7ae1a3affbc9f72e540d920363970307e0725fa838d611803251a4a08ccca1983d5b29a583758be63343e88f5591d885b8af695f33adbdd0d941d260287e32ef5a98fd55ac137211021fdc23b5d7a5469f578bf7aff6529117996f9ebab5e6dc7b047b356332fea82fdd620eb86f3c1d3855c8b8075da59a7662f4a11b977d996b8b3c7657ad4a82a20a7f76ce376c0320086ed029dd615399307983113cc0aa973ecba691e7e4cdc80aefa7e8c8347baba050eaca7dc35a21aa854e531dc7758d7d10b8c8e42c1be3bbf266d055ac25c37279ebefa28bbe89a34ad1ab3d23d7a66d1c216a57650e6ec9fc8ba7adfb38e57f20c467166c8fe7944e67f82138160002004812c78ba4b5f0da917da4cc14cf8fc10dba3f533facb11ef06d8b8f178ea9c5e8acbbca7b7f0e1f6b7a70ec2d5108cc41178056295793bed357accbb03c0582dc69bc77a34030f38cce256c5a9cec6e862146e3f0463f10dd5833257d0a0359166a7e2027d98eaf26cf0d5a4a05f6ef8b742f5d314a31deeeabe4ebc3106547e79c6cb933105d907b4c8c60443e97a154694bab5edfc781a438675b9de6ed03c77f51458eab61ca2e80ac02cc8c037d8fb3cf129d7107f618d66032cc02238a211f78bfa44e7c1bbcfcc627771c188d1b3713ce5e75cd2325a0a2ba08268cad13b27d97696ef678b592d0ac80ad1bacb4a1ba75bea8c477f39fc32c2aa20f352bb0da1c49b7d3927bcd9dfaf229237081d5fa08924fefd923ff0ac6baad6864b7c10dc73379a5ebd9e4678a0c26517656e8e51fca2a51a33fb2cdd5d76d12674c240ba9a4893c1af69b8f2c4adf37c4a47551eb2006a732f6b3b2f338c078ede33946dfe4a55bf644d3b98848693ada1fcb6fc16cac339ee65c24dc64b0ae92005354af00ade71e6c5e2efd85c46131d948ff14096b0f06a41d83c8522f30beb4eaaf4a6f908fe2a6ee754c896

GENERATE THE KEYS
Cleartext keys: cid=06b858ec6f80452b
initial_salt=9c108f98520a5c5c32968e950e8a2c5fe06d6c38

initial_secret (server in) =
7e0aba2c4b9742d0d130bc7318622ad3b44aca1f09abb19b3f394cd7e20f4be0
key=26080e60d288db7df816a1cb0bc6c7f4 iv=b9fdc5b448af3e023422443b
pn=00babbe1be0f0c6618188b4fcca57a96

Cleartext keys: cid=06b858ec6f80452b
initial_salt=9c108f98520a5c5c32968e950e8a2c5fe06d6c38
initial_secret (client in) =
82a73572e7cb89523b68c39eaa8325404f86498c8e2437dfdce10f9c34281a3d
key=a79943566c41342f2bc3de6b7c1539df iv=84eb954ffe161c3875919f5f
pn=5c0f6472a15658047a3cc1f15478dcf4

PNE DECRYPTION
PNE sample_offset=21 sample=c2973fa0d63fd9b03a4e163b990dd778
Decoded PN block (unknown length): c0000000
Packet number: 0 length=4

---

From: Rui Paulo <[email-masked]>
Date: Wed, 18 Jul 2018 12:42:35 -0700

My idea was to use the key/CID in PR #1573 to generate test vectors for the PNE so that there’s a logical progression in the appendixes.

> On Jul 18, 2018, at 07:11, Eric Rescorla <[email-masked]> wrote:
> 
> As discussed in the meeting, here is a test vector for PNE. It's an Initial packet generated by Kazuho but processed by Minq, with the output being an edited and annotated version of Minq's logging. Happy to help with more logging if that helps.
> 
> 
> INPUT PACKET
> Cleartext keys: cid=06b858ec6f80452b initial_salt=9c108f98520a5c5c32968e950e8a2c5fe06d6c38
> 
> initial_secret (server in) = 7e0aba2c4b9742d0d130bc7318622ad3b44aca1f09abb19b3f394cd7e20f4be0
> key=26080e60d288db7df816a1cb0bc6c7f4 iv=b9fdc5b448af3e023422443b pn=00babbe1be0f0c6618188b4fcca57a96
> 
> Cleartext keys: cid=06b858ec6f80452b initial_salt=9c108f98520a5c5c32968e950e8a2c5fe06d6c38
> initial_secret (client in) = 82a73572e7cb89523b68c39eaa8325404f86498c8e2437dfdce10f9c34281a3d
> key=a79943566c41342f2bc3de6b7c1539df iv=84eb954ffe161c3875919f5f pn=5c0f6472a15658047a3cc1f15478dcf4
> 
> PNE DECRYPTION

—
Rui Paulo

---

From: Christian Huitema <[email-masked]>
Date: Wed, 25 Jul 2018 22:37:58 -0700

> My idea was to use the key/CID in PR #1573 to generate test vectors for the PNE so that there’s a logical progression in the appendixes.

The test vectors provided by EKR are a super-set of the test vectors in
the Wiki. I think we will be better off just using them.

>> Cleartext keys: cid=06b858ec6f80452b initial_salt=9c108f98520a5c5c32968e950e8a2c5fe06d6c38

@EKR: could you also provide the value of the "initial_secret", as
defined in section 5.1.1 of the QUIC TLS draft? It is an interesting
intermediate value.

>> Packet number: 0 length=4

-- Christian Huitema

---

From: Martin Thomson <[email-masked]>
Date: Mon, 30 Jul 2018 19:36:16 +1000

I just implemented a hacky encrypt/decrypt routine for initial packets
and verified this message (not that that was necessary).

https://gist.github.com/martinthomson/7f4b615070254644f4c5335014980cbc

That implementation shows more intermediate values and might be easier
to tweak in order to produce sample values; for instance, it produces
a server Initial packet with an ACK and ServerHello.

I also verified the PNE mask here (65d8d307) using both AES-ECB and
AES-CTR (the API to which in nodejs is fantastically obtuse).