Re: [quicwg/base-drafts] Stateless reset comparisons (constant time/any order/datagram) (#2993)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> -If the last 16 bytes of the packet values are identical to a Stateless Reset
+An endpoint detects a potential stateless reset using the trailing 16 bytes of
+the UDP datagram.  An endpoint remembers all Stateless Reset Tokens associated
+with the connection IDs and remote addresses for datagrams it has recently sent.
+This includes Stateless Reset Tokens from NEW_CONNECTION_ID frames and the
+server's transport parameters but excludes Stateless Reset Tokens associated
+with connection IDs that are either unused or retired.  The endpoint identifies
+a received datagram as a stateless reset by comparing the last 16 bytes of the
+datagram with all Stateless Reset Tokens associated with the remote address on
+which the datagram was received.
+
+This comparison can be performed for every inbound datagram.  Endpoints MAY skip
+this check if any packet from a datagram is successfully processed.  However,
+the comparison MUST be performed when the first packet in an incoming datagram
+either cannot be associated with a connection, cannot be decrypted, or carries
+a duplicate packet number.

Yeah, I just worked through it and this is negatively good, because it implies that you have an early exit from the packet protection removal code.  That wouldn't be constant time in any way.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2993#discussion_r335716617