Re: [quicwg/base-drafts] Refine minimum DCID length of Initial (#2001)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> @@ -1318,6 +1318,11 @@ packet is received from the server, the client MUST use the same value unless it
 abandons the connection attempt and starts a new one. The initial Destination
 Connection ID is used to determine packet protection keys for Initial packets.
 
+A client SHOULD select a Destination Connection ID length long enough to fulfill
+the minimum for every QUIC version it supports. This makes it easier to detect
+version downgrade attacks, by increasing the chance Initial packets are routed
+to the same server.

This second sentence worries me.  The mechanism we have for detecting version downgrade is robust without consistent routing.  The problem here is that it might be too robust and - during a server upgrade - the server might change its mind.  Having stable routing ensures that the server can maintain state during the cut-over and avoid connections being killed as a result.  Given the complexities involved, I would suggest that we limit this to just the first sentence.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2001#pullrequestreview-174624774