Re: [quicwg/base-drafts] Request forgery attacks (#3995)

[Martin Thomson <[e-mail]>]

Adding PATH_CHALLENGE just adds a few unpredictable bytes, it doesn't really address the problem of control.  For that, you need something like the masking in websockets. 

The problem with something like masking is that it adds a fixed overhead to packets because you need to tell the recipient what the unpredictable stuff was and the size is determined by the number of attempts you might allow (see below).  Maybe that only applies to packets that are sent prior to address validation, so maybe you could repurpose one of the long header packet types (0-RTT?) to carry a masked payload in those cases, but it's a massive change.  I don't even want to think about making that sort of change right now...

The refragmenting idea is interesting.  The analysis supports the view that it is unnecessary for CRYPTO.  It might be too much work otherwise as well.  Skipping a random offset for STREAM frames might work, but you have to work through all the ways that an adversary might try to game out whatever strategy you adopt.  You need to ensure that the number of potential variations is at least the square of the number of attempts that an attacker might have (if you have 100 attempts, that's a minimum of 10,000 variations) or you hit the birthday bound and attacks become feasible in the aggregate.  Getting variations that high isn't necessarily that easy.  I'm not sure if it is worthwhile chasing that down.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3995#issuecomment-673820730