Re: [quicwg/base-drafts] Document request forgery (#3996)

Martin Thomson <> Wed, 19 August 2020 09:54 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id EEEEC3A16FD for <>; Wed, 19 Aug 2020 02:54:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.101
X-Spam-Status: No, score=-3.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id eb16SNj7SnNl for <>; Wed, 19 Aug 2020 02:54:48 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8A8B93A16FA for <>; Wed, 19 Aug 2020 02:54:48 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id B48AE840922 for <>; Wed, 19 Aug 2020 02:54:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1597830887; bh=ERF19LYzXvpVMG2IYqCLqxfZac5FDPZ25NXBaBQFAXg=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=0gsR3rCJ6elBwhrwvyOUqKnOS+xWCnGPeFCHa7SWfmGnczgJYTD6s4LDg40GNu1S+ sNhoBmQatjFEE4o33pupkXsZzakKsl7pWRIT3efDuXLmipvWQEZ47e0Jdp4FV5VtkV iLD3NOeeGk50VuanrjFF92sHiZXCAqvQrZM5AtyQ=
Date: Wed, 19 Aug 2020 02:54:47 -0700
From: Martin Thomson <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3996/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Document request forgery (#3996)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f3cf6e7a5dae_58bb1964174562"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: martinthomson
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 19 Aug 2020 09:54:51 -0000

@martinthomson commented on this pull request.

Thanks Jana,

I started applying these, then realized that I needed to rewrap and make other tweaks, so I've just made most of these changes, verbatim, as part of a manual commit.

> +
+Initial packet protection (Section 5.2 of {{QUIC-TLS}}) makes it difficult for
+servers to control the content of Initial packets. A client choosing an
+unpredictable Destination Connection ID ensures that servers are unable to
+control any of the encrypted portion of Initial packets. However, the Token
+field is open to server control and does allow a server to use clients to mount
+request forgery attacks.
+Use of tokens provided with the NEW_TOKEN frame ({{validate-future}}) offers
+the only option for request forgery during connection establishment.
+Clients are not obligated to use the NEW_TOKEN frame. Request forgery attacks
+that rely on the Token field can be avoided if clients do not include a value
+when the server address has changed from when the NEW_TOKEN frame was received.
+Clients MUST NOT send a token received in a NEW_TOKEN frame from one server

I'm at SHOULD NOT on my copy already.  I guess I forgot to push it.

> +For example, cross-site request forgery {{?CSRF=DOI.10.1145/1455770.1455782}}
+exploits on the Web cause a client to issue requests that include authorization
+cookies {{?COOKIE=RFC6265}}, allowing one site access to information and
+actions that are intended to be restricted to a different site.

I wanted to connect this with something that has a lot of existing documentation and explanatory material.  I found relatively little good material on the subject.

> +otherwise be unavailable to the attacker. For a networking protocol, a request
+forgery attack is often used to gain access to implicit authorization conferred
+by their peer's location in the network.
+For request forgery to be effective, an attacker needs to be able to influence
+what their peer sends, and where it is sent. If an attacker can target a
+vulnerable service with a controlled payload, that service might perform
+actions that are attributed to the attacker's peer, but decided by the
+For example, cross-site request forgery {{?CSRF=DOI.10.1145/1455770.1455782}}
+exploits on the Web cause a client to issue requests that include authorization
+cookies {{?COOKIE=RFC6265}}, allowing one site access to information and
+actions that are intended to be restricted to a different site.
+As QUIC runs over UDP, the primary attack modality of concern is one where an

I think I will pass on this one.  QUIC (this version, or invariants) run over UDP.

> +the data sent by QUIC endpoints is protected, this includes control over
+ciphertext. An attack is successful if an attacker can cause a peer to send a

We use a stream cipher, which is essentially an XOR with a predictable sequence.  If you know what the sequence is (this is trivial if you have the keys, just encrypt all zero values), then you know what the transform is and then, you can choose plaintext that is the XOR of the ciphertext you want.

> +encrypted portions of packets. It is necessary to assume that endpoints are
+able to control the contents of frames that a peer sends, especially those

This goes back to the encryption-by-XOR from above.  If I can control plaintext and make some good guesses about where it might appear, then I can control ciphertext.

> +This section assumes that limiting control over datagram content is not
+feasible. The focus of the mitigations in subsequent sections is on limiting

It would also be reasonable to implement some countermeasures that prevented control over datagram content.  The ciphertext fix does costs a lot though (it's a major change to the protocol that likely has a significant performance impact or requires the use of new ciphers) and it is not sufficient either as there are other more serious problems, like the SPA+connection ID one that I think we've agreed is too valuable a feature to dispense with (and options without this exposure are likely intractable for some server deployments).

I could write all of that down, but I thought it better to just state the assumption.

> +other types of packet to a destination that does not understand QUIC and is
+willing to accept connections.

I think that was supposed to be "....or is not willing to accept a QUIC connection"

> +the Token field. After sending a Retry, the server can also control the
+Destination Connection ID field of subsequent Initial packets from the client.
+This also might allow indirect control over the encrypted content of Initial
+packets. However, the exchange of a Retry packet validates the server address,
+thereby preventing the use of subsequent Initial packets for request forgery.
+### Request Forgery with Preferred Addresses
+Servers can specify a preferred address, which clients then migrate to after
+confirming the handshake; see {{preferred-address}}.
+The Destination Connection ID field of packets that the client sends to a
+preferred address can be used for request forgery.
+A client SHOULD NOT send non-probing frames to a preferred address prior to

I'm good with MUST NOT.

> +This document does not offer any additional specific countermeasures that can
+be implemented by endpoints aside from the generic measures described in

These countermeasures are not comprehensive.  Hence "additional".  Re-reading this though, I felt the need to reword...

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: