IETF Logo Mail Archive

Re: [quicwg/base-drafts] handling of coalesced packets with decryption errors creates DoS opportunity (#2308)

Igor Lubashev <notifications@github.com> Thu, 09 May 2019 12:13 UTC

Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 253F5120020 for <quic-issues@ietfa.amsl.com>; Thu, 9 May 2019 05:13:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.464
X-Spam-Level:
X-Spam-Status: No, score=-1.464 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VPyXWWA5dKNl for <quic-issues@ietfa.amsl.com>; Thu, 9 May 2019 05:13:28 -0700 (PDT)
Received: from out-19.smtp.github.com (out-19.smtp.github.com [192.30.252.202]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C561120006 for <quic-issues@ietf.org>; Thu, 9 May 2019 05:13:28 -0700 (PDT)
Date: Thu, 09 May 2019 05:13:27 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1557404007; bh=jXMK2aA1Ifg6xobbhb5tOVn2FCv5c0UuOuuOrwnguNs=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=bkITl2BvXKnIMEin9AmOKgOJNvBYW2Ie1eMkD38mJvyuCpyEonzLdbvThZc7SCwBt 30TzKVJzraV1m3auw8xkeQ1P5DD/bcBcl0kBaR8Loagx5pgKMKGux/s96x9gyNd3r5 DFh1ml0I5TTmJnUjDckHV6pdOLc7G3hAeD7buBgo=
From: Igor Lubashev <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+AFTOJK5Q6O26KIP5A6OABON24FF6PEVBNHHBPH547M@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2308/490877936@github.com>
In-Reply-To: <quicwg/base-drafts/issues/2308@github.com>
References: <quicwg/base-drafts/issues/2308@github.com>
Subject: Re: [quicwg/base-drafts] handling of coalesced packets with decryption errors creates DoS opportunity (#2308)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5cd419678eb56_79e83feea28cd9642589d4"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: igorlord
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/96u2tCI-ixqumDi2n3mHVRgQl7Q>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 May 2019 12:13:30 -0000

Coalescing for other-than-PMTU-discovery is to reduce the number of small datagrams. That's useful for reducing network bandwidth and CPU cost, especially for short connections.

So any kind of analysis for possible attacks should weigh a "Christmas Tree" coalesced packets vs. receiving each of the coalesced packets separately.  Coalescing makes sending such packets cheaper for the sender but it also makes it equally cheaper for the sever to receive.

My view is that packet coalescing is "neutral" in its effect on attack resilience of the protocol.  (One can actually say it is slightly beneficial, since it is harder to saturate network links with smaller datagrams.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2308#issuecomment-490877936

v2.46.0 | Report a Bug | By Email | System Status