Re: [quicwg/base-drafts] token-based greasing / initial packet protection (#3166)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> +NEW_TOKEN frame, the server generates the alternative initial salt by calling a
+pseudo-random function, embeds that initial salt into the token which is then
+encrypted, and sends a NEW_TOKEN frame that comprises of the generated token and
+the alternative initial set.
+
+When the client reconnects to the server by using the provided token and the
+alternative initial set, the server first checks if the version number field of
+the incoming packet contains one of the alternative version numbers it
+advertises, then if that is the case, applies the corresponding packet type
+modifier to recover the correct packet type.  If the recovered packet type is an
+Initial packet and that packet contains a NEW_TOKEN token, the server decrypts
+the embedded token and recovers the alternative initial salt, uses that to
+decrypt the payload of the Initial packet.
+
+When the server is incapable of determining the alternative initial salt, it can
+send a Version Negotiation packet that instructs the client to use the default

This PR has a built-in downgrade prevention mechanism.

The requirement we have in this PR is that each NEW_TOKEN token that the server issues is linked to a particular alternative version number.

When a server receives an Initial packet with an alternative version number it recognizes but with a token it cannot use, the server sends a VN. The client reconnects using V1, but the text in the PR requires the client to continue using the token. Then, when the server receives the V1 packet with the token, and can in fact use the token and finds out that the token was in fact being issued for a version other than V1, the server generates a VERSION_NEGOTIATION_ERROR.

In short, it is a downgrade attack if VN was issued while the token was usable.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3166#discussion_r340344021