Re: [quicwg/base-drafts] Version numbers (#113)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



>  
-* If the client's version is not acceptable to the server, the server MUST send
-  a Version Negotiation packet to the client.  This packet will have the VERSION
-  flag set and will include the server's set of supported versions.  On
-  subsequently received packets for the same connection ID with the unacceptable
-  version, the server MUST continue responding with a Version Negotiation
-  packet.
+If the packet contains a version that is acceptable to the server, the server
+proceeds with the handshake ({{handshake}}).  All subsequent packets sent by the
+server MUST have the VERSION flag unset.  This commits the server to the version
+that the client selected.

Yeah, I have a separate change that removes the text on triggering version negotiation based on the ALPN token.  This is simpler: negotiate a quic version, then negotiate an application protocol based on what is permitted within QUIC.

I haven't done a thorough analysis of what effect that has on the downgrade situation though.  So there might be some potential avenues of attack on the unauthenticated part of the negotiation.  My hope is that the version fields we've got in the transport parameters will detect those sorts of attack, but I'm not sure yet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/113