[Masque] Connection ID correlation attack on quic-proxy

[Martin Thomson <[e-mail]>]

There's a missing attack on the scramble transform that might be worth adding to the security considerations.  An attacker can modify packets to recover connection ID mappings.  This is, of course, trivial for the identity transform.

Consider a case where all connections that transit a proxy use padding to the same length.  All packets in and out of that proxy are indistinguishable.  An attacker could modify one packet to remove or add a byte.  That will allow them to correlate connection IDs across the proxy. 

That's a degenerate case of a more general attack.  Real connections are more variable, so it could require more packet modification to effect the same correlation.

This might be mitigated to some extent by adding padding when forwarding.

A possible fix for this, which would require protocol changes, would use the QUIC bit.  An encoded packet could use the QUIC bit to indicate the presence of padding.  I'd recommend using TLS-style padding, which involves any number of zero-valued bytes at the end of packets, plus a single non-zero marker byte.  To restore the original value of the QUIC bit, you would have to encode that bit in the padding, probably in the marker byte.

The alternative is to document the risk, which seems like a very reasonable thing to do.