[quicwg/base-drafts] NEW_TOKEN token and encryption (#2543)

[Kazuho Oku <[e-mail]>]

My understanding is that tokens provided by NEW_TOKEN frames should not leak information that allows observers correlate the newly established connection with the previous connection. Such information include the time when the token was issued, RTT, server name (when SNI is not used or Encrypted SNI is used).

However, the draft seems to be vague about the requirement. I think it might be worth clarifying the principle in the draft.

"a token SHOULD include an expiration time" (section 8.1.2) - I think we should change this to "a token SHOLUD be associated an expiration time", considering the fact that we are talking about "stateful" design (stateless design is mentioned briefly in one of the following paragraphs).

"In a stateless design, a server can use encrypted and authenticated tokens to pass information to clients" - I think we might prefer using "SHOULD" rather than "can".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543