Subject: [Ntp] Increasing minimum padding for NTS clients

From: Daniel Franke <[email-masked]>
Date: Sun, 18 Mar 2018 11:37:43 -0400

There's nothing in the NTS spec that says the server needs to use the
same nonce length as the client does in the Authenticator & Encrypted
Extensions EF. It just occurred to me that this is a potential
amplification vector. Even though it's a rather minimal one, I want to
fix this by requiring the client to include some extra padding at the
end of the extension. The required minimum amount of padding will be

max(min(N_MAX,16)-n,0) + 4

where `n` is the client's nonce length and N_MAX is defined by the
negotiated AEAD algorithm.

The idea behind this computation is that the server can always pick a
reasonable nonce size (the lesser of 16 or N_MAX) even if the client
picked a shorter one. The `+ 4` compensates for the issue we observed
yesterday (and someone, I forget whom, previously predicted) that
encrypting NTS Cookie EF can necessitate generating an extra row of
padding to conform to the four-octet alignment.

Martin, do you think you can add this behavior to your client in time
for Tuesday? If you're currently always generating 16-octet nonces,
then it simplifies to nothing more than a matter of "always generate
at least four octets of padding" rather than the current "always
generate at least one octet of padding".