Re: [quicwg/base-drafts] Rework Retry packet (#1498)
MikkelFJ <notifications@github.com> Thu, 19 July 2018 06:18 UTC
Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD713130E8D for <quic-issues@ietfa.amsl.com>; Wed, 18 Jul 2018 23:18:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.01
X-Spam-Level:
X-Spam-Status: No, score=-8.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YLpUeQc7dvhc for <quic-issues@ietfa.amsl.com>; Wed, 18 Jul 2018 23:18:49 -0700 (PDT)
Received: from out-15.smtp.github.com (out-15.smtp.github.com [192.30.254.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50916128CF3 for <quic-issues@ietf.org>; Wed, 18 Jul 2018 23:18:49 -0700 (PDT)
Date: Wed, 18 Jul 2018 23:18:48 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1531981128; bh=b5Rtep8XNXkc4wVfAUXDZF2zTXaJO8nB4ZCkigKfsZY=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=0oUectKxRypvUCZst5gsHYhqsg0kR4jEbmHgPWTqG9zgnbLv97KhezOENudfji7CB 03vzL3nyjWjMArggAQS2Fjo+zdYkaXUpEqA3nw8dIwCPpXLifReImW4WBWjS6Rod3+ YsfG/RnfPQ0l9UT8vNCHWUmECcyvhwDHcROWAlYY=
From: MikkelFJ <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+0166e4aba52889a8c886a8ad81f94f490aa7872de054a7b492cf000000011767ef4892a169ce14138c09@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/1498/review/138534684@github.com>
In-Reply-To: <quicwg/base-drafts/pull/1498@github.com>
References: <quicwg/base-drafts/pull/1498@github.com>
Subject: Re: [quicwg/base-drafts] Rework Retry packet (#1498)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5b502d4868f40_52803f83942bef883773e4"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: mikkelfj
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/EWo5Fy-4TnMhPfQ8NhSJRiBI5io>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.27
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Jul 2018 06:18:52 -0000
mikkelfj commented on this pull request. > +A Retry packet does not include a packet number and cannot be explictly +acknowledged by a client. + +A server MUST only send a Retry in response to a client Initial packet. + +If the Original Destination Connection ID field does not match the Destination +Connection ID from the most recent Initial packet it sent, clients MUST discard +the packet. This prevents an off-path attacker from injecting a Retry packet. + +The client responds to a Retry packet with an Initial packet that includes the +provided Retry Token to continue connection establishment. + +A server that might send another Retry packet in response to a subsequent +Initial packet MUST set the Source Connection ID to a new value of at least 8 +octets in length. This allows clients to distinguish between Retry packets when +the server sends multiple rounds of Retry packets. Consequently, a valid Retry @nibanks > Instead of requiring the server to use a new CID, why not just make the client use a new random CID for every new token it sends in the Initial packet? The clients source SCID must be new. The clients original DCID is always new and random in an initial packet. Only the source is reflected back by the server. this is why it must be new. The alternative would be to have a separate nonce in the handshake, separate from SCID, which is what I suggest. On the going further: The server must set is own SCID - otherwise the server is forced to use a client chosen SCID which is not only a load balancer issue and it also goes against the point of a retry. A retry is a redirect to another server, not try again until you get lucky, although that can also be implemented if the server randomizes its SCID. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/quicwg/base-drafts/pull/1498#discussion_r203612261
- Re: [quicwg/base-drafts] Rework Retry packet (#14… janaiyengar
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Christian Huitema
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Kazuho Oku
- Re: [quicwg/base-drafts] Rework Retry packet (#14… ekr
- [quicwg/base-drafts] Rework Retry packet (#1498) Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… ekr
- Re: [quicwg/base-drafts] Rework Retry packet (#14… ianswett
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Mike Bishop
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… ianswett
- Re: [quicwg/base-drafts] Rework Retry packet (#14… ianswett
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Christian Huitema
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Mike Bishop
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Mike Bishop
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Marten Seemann
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Christian Huitema
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Marten Seemann
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… MikkelFJ
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Nick Banks
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson
- Re: [quicwg/base-drafts] Rework Retry packet (#14… Martin Thomson