Re: [quicwg/base-drafts] Let Endpoints Ignore invalid Initial Packets (#1819)

[Martin Thomson <[e-mail]>]

As I said in #1890, I don't think that we want to do this.  Not only because it requires a lot of words that are very hard to get right.

Yes, an implementation can attempt to manage state in a way that is resilient to interference in the handshake.  Every packet that can be successfully processed relative to any pre-existing checkpoint in the state of the connection adds another dependent checkpoint to that tree.  For instance, should I have received N packets, I would have potentially 2^N copies of the nascent connection state as a result, though likely fewer as each packet is likely only valid when interpreted from a certain subset of those states.  When a packet causes the connection to be successfully established, other states can then be discarded.

I've heard that there are partial approaches that are less onerous than the fully exhaustive option and this advocates for something in that space.

I don't think that we need to specify any of that.  On the positive side, I don't think that anything we write into the draft would prohibit someone from implementing these techniques.  They might be complex, but it would be very nice if we could do away with packet injection attacks being used to interfere with connection establishment.  

In the end, this runs directly counter to what we already agreed was the guidelines: we would not put in measures that prevented an attacker from interfering with connection establishment if they were able to observe and inject packets.  QUICv2 seems like the right place for this, if anything.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1819#issuecomment-431247799