[quicwg/base-drafts] Guard initial packet against amplification attack via compression (#596)
MikkelFJ <notifications@github.com> Tue, 06 June 2017 14:55 UTC
Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFE4512949F for <quic-issues@ietfa.amsl.com>; Tue, 6 Jun 2017 07:55:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.402
X-Spam-Level:
X-Spam-Status: No, score=-5.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UYWO3qKMuF5X for <quic-issues@ietfa.amsl.com>; Tue, 6 Jun 2017 07:55:03 -0700 (PDT)
Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext8.iad.github.net [192.30.252.199]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 022C91293F4 for <quic-issues@ietf.org>; Tue, 6 Jun 2017 07:55:01 -0700 (PDT)
Date: Tue, 06 Jun 2017 07:55:00 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1496760900; bh=3rKj0dUSAQZioNJN8BEAFREcU6AhiAGgRDQBClQxroc=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=Jpd7+Jta654RjQkCDlOOsMYvbeMV95BPb+B91mTAaftNbXIau5UuiD2ecIpP7CNaD +13Y+A9zzBuJ9zRdPqxc/WXMgYwE2rIHuqD1spASqSfiYZ9W2tWeeNMYCNm1nIdomu HbWtfxiV2MeDsWdotjk9WxVwy9QXZ1HdQO2jPfKI=
From: MikkelFJ <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+0166e4ab463f4e197eaac97e7090b774645a606fe25e031292cf00000001154e844492a169ce0df15566@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/596@github.com>
Subject: [quicwg/base-drafts] Guard initial packet against amplification attack via compression (#596)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5936c24441bcd_405b3f84670cfc307969"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: mikkelfj
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/3qxZrCzloumxdlxppBt7HLmzDWM>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.22
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Jun 2017 14:55:05 -0000
If an attacker has access to a network with efficient IP payload compression, it may be comparatively cheap for the sender to transmit Client Initial packets even if the packets are required to be 1280 bytes long. This can be mitigated by replacing padding with random data, or a some pattern that is not trivially compressible. I am not familiar with options today, but the following RFC do discuss such a compression technology, and other options may appear in the future: https://tools.ietf.org/html/rfc3173 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/quicwg/base-drafts/issues/596
- [quicwg/base-drafts] Guard initial packet against… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… Martin Thomson
- Re: [quicwg/base-drafts] Guard initial packet aga… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… ianswett
- Re: [quicwg/base-drafts] Guard initial packet aga… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… MikkelFJ
- Re: [quicwg/base-drafts] Guard initial packet aga… Martin Thomson
- Re: [quicwg/base-drafts] Guard initial packet aga… Martin Thomson