Re: [quicwg/base-drafts] Discard Initial keys as soon as possible (#2045)

[Rui Paulo <[e-mail]>]

rpaulo commented on this pull request.



> @@ -691,6 +692,24 @@ will be marked as lost before this, as they leave a gap in the sequence of
 packet numbers.
 
 
+## Discarding Initial Keys {#discard-initial}
+
+Packets protected with Initial secrets ({{initial-secrets}}) are not
+authenticated, meaning that an attacker could spoof packets with the intent to
+disrupt a connection.  To limit these attacks, Initial packet protection keys
+can be discarded more aggressively than other keys.
+
+The successful use of Handshake packets indicates that no more Initial packets
+need to be exchanged, as these keys can only be produced after receiving all
+CRYPTO frames from Initial packets.  Thus, a client MUST discard Initial keys
+when it first sends a Handshake packet and a server MUST discard Initial keys
+when it first successfully processes a Handshake packet.  Endpoints MUST NOT
+send Initial packets after this point.

Okay, I see what you mean.  I think that from a transport protocol perspective, not sending an ACK isn't good since you just ignored a possible RTT estimation.  You could estimate the RTT from the new handshake packet, I suppose, but that's not how the transport part works.

I'm not sure I understand the attack since to spoof the initial packet,  the third party must be doing a man in the middle attack.  In that case, why not do it early and abuse the stateless reset or retry?



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2045#discussion_r236052467