Re: [quicwg/base-drafts] Handling of connection ID in handshake creates corner cases (#843)

[Ryan Hamilton <[e-mail]>]

On Mon, Oct 9, 2017 at 11:03 AM, Christian Huitema <[e-mail]
> wrote:

> @RyanAtGoogle <https://github.com/ryanatgoogle> no, encrypting with the
> connection ID will not be sufficient. According to the spec, the Client
> Initial carries the client-chosen initial connection ID, but the Server
> Clear text carries the server chosen connection ID, which the client is
> supposed to adopt and then use for all consecutive packets. So the client
> will read the connection ID from the message header, and use it to decrypt
> the message. It will work, whether using connection ID #1
> <https://github.com/quicwg/base-drafts/pull/1> or #2
> <https://github.com/quicwg/base-drafts/issues/2>.
>
But if the server packet for connection 1 is encrypted with client
connection ID 1, and the server packet for connection 2 is encrypted with
client connection ID 2, there should be ​no confusion. Of course, if the
server encrypts the packet with the *server* connection ID, then that would
not works, but we would also have off-path attacker problems.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/843#issuecomment-335254306