Re: [quicwg/base-drafts] Amplification attack using retry tokens and spoofed addresses (#2064)

[Christian Huitema <[e-mail]>]

@marten-seemann if I recall correctly, there was an intense discussion about 0-RTT and session ticket reuse in the TLS working group. Some forms of 0-RTT replay attacks can be prevented if session tickets are used at most once, or at least if session tickets enable 0-RTT data at most once per use. That discussion showed that at-most-once was very hard to handle in a big server farm, as it would require centralized management of state across many servers. See section 8 of RFC8446, "0-RTT and Anti-Replay" for the resulting compromise.

I understand that ensuring at-most-once with tokens might seem equally hard, although there is a possible solution in QUIC that is not available in TLS. The basic QUIC server farm architecture assumes that load balancers route packets to specific servers based on the destination CID. It should be possible to have that CID be a function of the content of the retry token. That could be as simple as allocating the destination CID before formatting the NEW TOKEN, and having that reserved CID part of the encrypted content of the token. The load balancer could then routed based on the CID decrypted from the token, and the individual server could select the destination CID based on the token. That would definitely limit token reuse.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2064#issuecomment-445331050