Re: [quicwg/base-drafts] introduce a version alias mechanism (#2573)

["Philipp S. Tiesel" <[e-mail]>]

philsbln commented on this pull request.

I just realised that requiring the server to announce (some of the) version aliases over the whole lifetime may give us downgrade protection for free. That also allows us to keep version alias and version downgrade protection separate.

> -
+## Version Aliases
+
+In order to avoid ossification of the version number defined by this draft,
+servers announce a list of version numbers that they interpret as an alias for
+the version number used in this draft. Alias versions MUST NOT be a reserved
+version. Servers SHOULD send at least one version alias, and SHOULD frequently
+change the value that they announce. Each version alias contains a lifetime,
+which indicates how long the server will accept this version alias. It also
+contains an initial salt, which is used instead of the initial salt as defined
+in section 5.2 of {{QUIC-TLS}}. The list of version aliases is sent in the
+server's Transport Parameters (see {{transport-parameter-definitions}}).
+
+Clients SHOULD remember the aliases and use it for subsequent connections to the
+same server in the future. This applies to both 0-RTT connection as well as
+connections that don't use 0-RTT.
 

We should add a note that Version Aliases must not be advertised during version negotiation

```suggestion
Version aliases MUST NOT be advertised in version negotiation Packets to avoid conflicts with future versions and experiments.
```

> @@ -4115,6 +4130,25 @@ preferred_address (0x000d):
 ~~~
 {: #fig-preferred-address title="Preferred Address format"}
 
+version_aliases (0x000e):
+
+: A list of version numbers that the server accepts as an alias for the
+  currently used versions. This transport parameter is only sent by the server.
+  Every version alias contains a lifetime in milliseconds. The alias is only valid
+  for that lifetime, clients MUST NOT use it after expiry.
+

Should we require the server to announce (some) of the version aliases during their whole lifetime to enable the client to detect downgrade attacks?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2573#pullrequestreview-224333650