Re: [quicwg/base-drafts] Authenticate connection IDs (#3499)

[Christian Huitema <[e-mail]>]

@huitema commented on this pull request.



> @@ -1475,6 +1475,49 @@ lifetime of a connection, especially in response to connection migration
 ({{migration}}); see {{issue-cid}} for details.
 
 
+## Authenticating Connection IDs {#cid-auth}
+
+The choice each endpoint makes about connection IDs during the handshake is
+authenticated by including all values in transport parameters; see
+{{transport-parameters}}. This ensures that all connection IDs used for the
+handshake are also authenticated by the cryptographic handshake.
+
+Each endpoint includes the value of the Source Connection ID field from the most
+recent Initial packet it sent in the initial_connection_id transport
+parameter; see {{transport-parameter-definitions}}. A server includes the
+Destination Connection ID field it receives in original Initial packets from the

We already have a definition for an original_connection_id transport parameter (see section  17.2.5.3. of the transport spec, Continuing a Handshake After Retry). From the point of view of the client, we have the following:

1) Without retry:
* Initial DCID: DCID of the first Initial packet sent by the client.
* Server SCID: CID chosen by the server to identify the connection during the handshake. Also used by the client for further Initial or Handshake packets once the client receives a first handshake message from the server.

2) With Retry:
* Original DCID: the DCID in the first Initial packet sent by the client, when that packet triggered a Retry.
* Server suggested DCID: the SCID of the Retry packet sent by the server. 
* Initial DCID: the DCID in the first Initial packet sent by the client in response to the Retry. MUST be set to the Server suggested DCID.
* Server SCID: the SCID chosen by the server to identify the connection. May or may not be the same as Server suggested DCID.

Maybe we should tighten these definitions.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3499#discussion_r422432965