Re: [Last-Call] Last Call: <draft-gont-numeric-ids-sec-considerations-06.txt> (Security Considerations for Transient Numeric Identifiers Employed in Network Protocols) to Best Current Practice

[Martin Thomson <[e-mail]>]

Everything else Christian says here about QUIC is accurate.  I see nothing there that suggests a problem in need of attention.  I would also point to https://tools.ietf.org/html/draft-ietf-quic-load-balancers for a more nuanced treatment of the connection ID selection problem.

On Thu, Dec 17, 2020, at 16:19, Christian Huitema wrote:
> An informational document documenting a series 
> of past attacks would be interesting and educational. The kind of rule 
> making proposed in the draft, on the other hand, would be mostly harmful.

...but this is the most important message.  Removing Section 5 and all that depends on it would make this a better document.

Separately, I found the list of potential problems in Section 4 to be approximately OK, though it lacked any mention of a need to synchronize changes across protocol layers.  I acknowledge that that is about use rather than generation, but that is quite relevant here too.