<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 7/22/2021 6:17 AM, Richard
Outerbridge wrote:<br>
</div>
<blockquote type="cite"
cite="mid:A76C9910-47FA-41F1-B538-487FA58DD554@interlog.com">
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">n 2021-07-21 (202), at 23:43:20, Christian Huitema <a class="moz-txt-link-rfc2396E" href="mailto:huitema@huitema.net" moz-do-not-send="true"><huitema@huitema.net></a> wrote:
On 7/20/2021 6:48 PM, Ray Dillinger wrote:
</pre>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">On 7/20/21 6:11 PM, Peter Gutmann wrote:
</pre>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">Ray Dillinger <a class="moz-txt-link-rfc2396E" href="mailto:bear@sonic.net" moz-do-not-send="true"><bear@sonic.net></a> writes:
</pre>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">I don't think NaCl as it is today is vulnerable
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Unless it's changed recently, the NaCL API assumes the nonce is user-supplied,
which means it's completely vulnerable. It's RC4 as used in the 1990s all
over again.
Peter.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Aw crap. I'm so sorry to hear that, I thought it was better.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">For AEAD, both ends of a communication channel have to agree on what the nonce is, and communication protocols have to specify that. For example, the nonce used in QUIC is a 64 bit packet number, guaranteed to occur at most once for the duration of the connection. But only the least significant bits of the packet number are sent in the packet, the rest is inferred. Which means the nonce is only known by the protocol logic. There has to be an API to pass it to the implementation of AES-GCM or ChaCha-poly. Which means the crypto library API needs to assume that the nonce is user supplied.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">In this case it sounds like the nonce has become (more or less) a PSK.</pre>
</blockquote>
<p>Except it is not really "Private". Observers can count packets
and make a pretty good guess of the value of the sequence number.
There is definitely no claim that the nonce is not predictable in
QUIC, and no particular engineering effort to make it so. No point
replicating for the nonce the work made to protect the encryption
keys.<br>
</p>
<p>-- Christian Huitema<br>
</p>
</body>
</html>