Is the example in the QUIC spec for header encryption wrong, or have I missed something?

Question

In the QUIC spec, they've provided an example of header protection:

https://datatracker.ietf.org/doc/html/rfc9001#name-sample-packet-protection

They've got the following process (paraphrasing):

hp = c206b8d9b9f0f37644430b490eeaa314
sample = d1b1c98dd7689fb8ec11d242b123dc9b
mask = AES-ECB(hp, sample)[0..4]
     = 437b9aec36

But, when I try to replicate it (e.g.):

echo 'd1b1c98dd7689fb8ec11d242b123dc9b' | xxd -r -p - sample  # Convert hex to file
openssl enc -aes-128-ecb -in sample -out outfile -K c206b8d9b9f0f37644430b490eeaa314 -e -nopad
head -c 5 outfile | xxd

I get 165287d918. I've tried 3 different AES-128 ECB implementations (i.e. 2 in C, one in Javascript) - always the same result.

I must be getting something wrong, but it's such a straightforward task that I can't imagine what.

Answer 1

You have the wrong key (or the right key for the wrong plaintext). For the Initial packet of the client, you need the header protection key of the client, which in the example is

9f50449e04a0e810283a1e9933adedd2

You used the server hp key.