Re: [quicwg/base-drafts] Limit RCID state (#3547)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> @@ -1069,6 +1069,15 @@ to cease using the connection IDs when requested can result in connection
 failures, as the issuing endpoint might be unable to continue using the
 connection IDs with the active connection.
 
+An endpoint SHOULD limit the number of outstanding RETIRE_CONNECTION_ID frames
+to bound the necessary state. In order to allow a peer to retire all previously
+issued connection IDs, the limit on the number of outstanding
+RETIRE_CONNECTION_IDs SHOULD be at least the active_connection_id_limit. An

> The endpoint can say "I will only have 10 RCIDs in flight at a time".

Yes. That's possible, but having that limitation does not mitigate the attack.

> So if the peer makes me send 20, it'll take me at least 2 RTTs to resolve. Now obviously it can take longer if I don't have enough cwnd, but that's orthogonal to this and no change to the spec.

The attack is that peer might make you send more than 20 or more. And we need to either provide a guidance on when an endpoint can start leaking retirements or close the connection.

However, the only SHOULD being added in this PR is something unrelated to the attack. And the location of the text gives the false impression that the limit in that sentence is the threshold for mitigating the attack.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3547#discussion_r401984660