Re: [quicwg/base-drafts] Add initial threat model appendix (#2925)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.

I'll wait until this is revised before doing the hard stuff.  Some easy comments though to keep things motivated.

> @@ -5753,13 +5753,184 @@ DecodePacketNumber(largest_pn, truncated_pn, pn_nbits):
    return candidate_pn
 ~~~
 
+# Overview of Security Properties {#security-properties}

This is probably better placed as a "Security Considerations" section, with the current text incorporated into this as appropriate (mostly under mitigations).

> +separately.
+
+## Handshake {#handshake-properties}
+
+TBD.
+
+## Short Headers {#short-headers-properties}
+
+TBD.
+
+## Connection Migration {#migration-properties}
+
+Connection Migration ({{migration}}) provides endpoints with the ability to
+transition between IP addresses and ports on multiple paths, using one path at a
+time for sending non-probing frames.  Path validation helps to establish
+bidirectional connectivity with the peer over a new path and prevents source

The purpose of path validation is to establish that a peer is both willing and able to receive packets sent on the path.  This helps reduce the effects of address spoofing, by limiting the number of packets sent to a spoofed address, unless an attacker is able to also receive packets sent to that address.

> +## Handshake {#handshake-properties}
+
+TBD.
+
+## Short Headers {#short-headers-properties}
+
+TBD.
+
+## Connection Migration {#migration-properties}
+
+Connection Migration ({{migration}}) provides endpoints with the ability to
+transition between IP addresses and ports on multiple paths, using one path at a
+time for sending non-probing frames.  Path validation helps to establish
+bidirectional connectivity with the peer over a new path and prevents source
+address spoofing from being used in a denial-of-service attack.  Migration is
+further restricted to be initiated only by QUIC clients.

I think that this is not a security property as much as it is a correctness or simplicity choice we made.  You can drop this sentence.

> +
+An on-path attacker is present between the QUIC client and server, and an
+endpoint is required to send packets through this attacker to establish
+connectivity on a given path.
+
+An on-path attacker can:
+
+- Inspect packets
+- Modify unencrypted packet headers
+- Inject new packets
+- Delay packets
+- Drop packets
+
+An on-path attacker cannot:
+
+- Modify encrypted packet payloads

Mike's point is excellent.  The point is that packets are authenticated.

> +attacks, requiring injection of packets into the network, as described in
+{{?RFC3552}}.
+
+### On-Path Attacker
+
+An on-path attacker is present between the QUIC client and server, and an
+endpoint is required to send packets through this attacker to establish
+connectivity on a given path.
+
+An on-path attacker can:
+
+- Inspect packets
+- Modify unencrypted packet headers
+- Inject new packets
+- Delay packets
+- Drop packets

Another point on capabilities - an on-path attacker can split datagrams that contain multiple packets and merge packets into a single datagram.

> +
+This section describes the intended security properties of connection migration
+when under attack by the following attackers.  These attackers all mount active
+attacks, requiring injection of packets into the network, as described in
+{{?RFC3552}}.
+
+### On-Path Attacker
+
+An on-path attacker is present between the QUIC client and server, and an
+endpoint is required to send packets through this attacker to establish
+connectivity on a given path.
+
+An on-path attacker can:
+
+- Inspect packets
+- Modify unencrypted packet headers

```suggestion
- Modify IP and UDP packet headers
```

> +An on-path attacker can:
+
+- Inspect packets
+- Modify unencrypted packet headers
+- Inject new packets
+- Delay packets
+- Drop packets
+
+An on-path attacker cannot:
+
+- Modify encrypted packet payloads
+
+In the presence of an on-path attacker, QUIC aims to provide the following
+properties.
+
+1. An on-path attacker can interrupt a QUIC connection, causing it to fail if it

The attacker doesn't interrupt the connection as much as it can prevent use of the path for that connection.

There is a special case for connection establishment that needs to be called out separately, in that an attacker can prevent connection establishment with much less interaction (i.e., it doesn't need to disrupt every packet).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#pullrequestreview-272335716