Re: [quicwg/base-drafts] Client's initial destination CID is unauthenticated (#1486)

[Kazuho Oku <[e-mail]>]

> The current design allows for considerable flexibility in routing up until the point that the first Handshake packet commits to a set of connection IDs. Part of that flexibility allows for changing the connection ID.
> 
> A server could decide to validate changes using the token it passes to clients in Retry packets, if it chose to do so.

My point is that it cannot.

Consider the following case:
* a middlebox intercepts the 1st Initial, drops it, and sends back a Retry that contains a 8-octet SCID field that has the value that the middlebox wants
* client sends an Initial packet with the updated server CID and token found in the Retry
* the middlebox trims the Retry field, re-obfuscates the Initial packet and forwards it to the server

The initial packet being altered by a middlebox will look as if it was a Initial packet without a token sent from a client. A server cannot tell if the Destination CID field of the Initial packet was generated by the client or by a middlebox.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1486#issuecomment-400543918