Subject: About to merge: first octet rework

From: Martin Thomson <[email-masked]>
Date: Tue, 20 Nov 2018 14:56:43 +1100

https://github.com/quicwg/base-drafts/pull/2006 has attracted a lot of
discussion, but I think that it is ready.  I expect to merge it soon.

There are two open with header protection that have flared up as a
result of discussion on that:

https://github.com/quicwg/base-drafts/issues/1575 suggests that we
require padding of the payload so that we don't have to change the
offset of the ciphertext sample.  For those who use 1 or 2 byte packet
number encodings, this would mean that they have to add 2 or 1 PADDING
frames if there is less than 3 (or 2) bytes of frames.  If packet
numbers are 3 or 4 bytes, no padding is necessary.  The proposal here
is to make that change.

https://github.com/quicwg/base-drafts/issues/2019 suggests that we
don't always have enough to sample for header protection.  The
previous fix might suggest that more padding could be used to solve
the problems with this sort of cipher, but it doesn't seem like this
is an important cipher suite.  The proposal here is to explicitly
declare the offending CCM-8 cipher suite unsupported, but not to
recommend any particular recourse.

Igor also opened #2022, but it seems like the overwhelming reaction
has been in favour of no change.

---

From: Mikkel Fahnøe Jørgensen <[email-masked]>
Date: Tue, 20 Nov 2018 09:24:03 +0000

Note that existing pseudocode does not bound check sample length, and othet existing text mentions all ciphers in TLS 1.3 have tag length 16 bytes. This probably still needs to be addressed somehow.

________________________________
Fra: QUIC <[email-masked]> på vegne af Martin Thomson <[email-masked]>
Sendt: tirsdag, november 20, 2018 4:57 AM
Til: QUIC WG
Emne: About to merge: first octet rework