Re: [quicwg/base-drafts] Stateless Reset needs "on-path" proof (#1230)

[Mike Bishop <[e-mail]>]

Another attack to consider along similar lines:  If an active attacker observes the CID being used by a client, sends a packet with that CID to a different server endpoint that shares the same SR token algorithm/key, then it can get the other endpoint to effectively be an oracle for the stateless reset token.  It can then inject a Stateless Reset with the token into the current connection.

One mitigation would be to say that it's the server deployment's problem -- you should have different SR token-generation keys between different endpoints.  Another is to require that a Stateless Reset was sent by someone who had both a specific packet you sent and the token, without disclosing the token in a form that could be adapted to a different rejected packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1230#issuecomment-378749434