Re: [quicwg/base-drafts] PMTUD (kitchen-sink version) (#106)

[martinduke <[e-mail]>]

martinduke commented on this pull request.



> +
+QUIC endpoints MAY set DF and pad packets when implementing probes as described in
+{{!RFC1191}}, {{!RFC1981}}, or {{!RFC4821}}.
+
+QUIC endpoints MAY set DF and pad packets when it has evidence that the path between two
+previously used IP addresses has changed.
+
+### Special Considerations for Path MTU Discovery 
+
+Traditional ICMP-based path MTU discovery ({{!RFC1191}}, {{!RFC1981}}) is
+potentially vulnerable to off-path attacks that succesfully guess the IP/port 4-tuple
+and reduce the MTU to a bandwidth-inefficient value. TCP connections mitigate this
+risk by using the (at minimum) 8 bytes of transport header echoed in the ICMP message
+to validate the TCP sequence number as valid for the current connection. However, as
+QUIC operates over UDP, this echoed information may consist only of the IP and UDP
+headers, which hold no connection-specific context except the IP/port 4-tuple.

That's a good point. How about "this echoed information may consist only of the IP and UDP headers, which usually has insufficient entropy to mitigate off-path attacks." ?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/106