Re: [quicwg/base-drafts] Attacks Against Address Migration (#2582)

[Martin Thomson <[e-mail]>]

Yeah, we gotta go full design here.  This is a major change to the path validation logic.

There's a good case here for the change: path validation is currently unnecessarily symmetric. The decision to consider a path valid is a decision each peer makes unilaterally.  That is, for the path to be used, both peers need to independently validate that packets sent on that path reach the other side.  We don't need the PATH_RESPONSE to follow the path because we expect the peer to also send a PATH_CHALLENGE down that path.

The requirement that PATH_RESPONSE follow the path is a case of trying to attain or enforce behaviour from a peer unnecessarily.  An endpoint doesn't need to be assured that its peer has also validated the path, but that is what the existing text attempts to assure.  If a peer decides not to validate a path, then that is on them.

The fix here prevents an attacker from using the fact that duplicate packets are dropped to prevent path validation.  And I can't see a down side.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2582#issuecomment-486054142