Re: [quicwg/base-drafts] Avoid attack on address validation during connection migration (#746)

[Christian Huitema <[e-mail]>]

huitema commented on this pull request.

I think we are still missing something. We need to somehow tie the packets to the new path, in a cryptographic way. One potential solution is to use a new connection ID for the new path. That way, third parties cannot forward a PING or PONG meant for one path to the other path. But this needs work. And yes, it is very close to multipath.

> @@ -1453,6 +1453,10 @@ return.  A PING frame containing 12 randomly generated {{?RFC4086}} octets is
 sufficient to ensure that it is easier to receive the packet than it is to guess
 the value correctly.
 
+Note:
+
+: Retransmissions of the PING frame MUST also use the same remote address.
+
 If validation of the new remote address fails, after allowing enough time for

Really? That seems to contradict what you are saying later.

> +received, but it could also mean ceasing retransmissions of the PING frame.  An
+endpoint that doesn't retransmit a PING frame might receive a PONG frame, which
+it MUST ignore.
+
+
+## Spurious Connection Migrations
+
+A connection migration could be triggered by an attacker that is able to capture
+and forward a packet such that it arrives before the legitimate copy of that
+packet.  Such a packet will appear to be a legitimate connection migration and
+the legitimate copy will be dropped as a duplicate.
+
+After a spurious migration, validation of the source address will fail because
+the entity at the source address does not have the necessary cryptographic keys
+to read or respond to the PING frame that is sent to it, even if it wanted to.
+Such a spurious connection migration could result in the connection being

The text is correct, except if the man on the side manages to play "man in the middle". It knows that the first packet to the new address will be a PING. It could forward it to the old address, capture the next packet from that old address, and forward it again to the target. Bingo, the PONG succeeds.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/746#pullrequestreview-57967334