Re: [quicwg/base-drafts] The method of identifying "the same server" (#3155)

[Kazuho Oku <[e-mail]>]

@igorlord No.

The concern is on the server-side, where three parties are involved: a) owner of LB (that only sees unencrypted traffic), b) owner of one server behing _a_, c) owner of another backend server behind _a_, who can also monitor the traffic between clients and _a_.

The attack goes like this:
1. _c_ accepts a connection from a legitimate client (through _a_), and issues a NEW_TOKEN token
2. The client reconnects to _b_ (through _a_), using the the token obtained in step 1. At this point, _c_ can tell that who connected to _b_.

Going back to our design principle; we require NEW_TOKEN tokens (and also TLS session tickets) to be sent using an encrypted channel, and to be used only once, because the fact that the client is connecting to a particular server should not be exposed to a third party. In this example, we are violating that requirement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3155#issuecomment-549337407