Re: [quicwg/base-drafts] Retire My Own CID (#2645)
David Schinazi <notifications@github.com> Tue, 11 June 2019 22:06 UTC
Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2271512006A for <quic-issues@ietfa.amsl.com>; Tue, 11 Jun 2019 15:06:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.009
X-Spam-Level:
X-Spam-Status: No, score=-8.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7lKoPiLJjub2 for <quic-issues@ietfa.amsl.com>; Tue, 11 Jun 2019 15:06:42 -0700 (PDT)
Received: from out-7.smtp.github.com (out-7.smtp.github.com [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB95012001E for <quic-issues@ietf.org>; Tue, 11 Jun 2019 15:06:41 -0700 (PDT)
Date: Tue, 11 Jun 2019 15:06:40 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1560290800; bh=YJSiQQXuaKXtM8u9FbFwGR3zfba+FxFNtlVIXxsrDCA=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=oYBsS+oGh1rn1bvPQUgFM4h3apXg/t/EraOamC/DkWBrZGVZtOK1pFrrjW7L45K6D eznd6s1lImPDiaqajDnFV2/HdJLhecvhIX+bqikifCPUt7ici292hdtjnmy+o1+7lX ics5D3yybtzUQgjuz2SBJwMUY7P585M03RTPtaj0=
From: David Schinazi <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+AFTOJK5QFRNJMYW6LGTQWRV3BVMHBEVBNHHBUAUCHA@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2645/501041204@github.com>
In-Reply-To: <quicwg/base-drafts/issues/2645@github.com>
References: <quicwg/base-drafts/issues/2645@github.com>
Subject: Re: [quicwg/base-drafts] Retire My Own CID (#2645)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5d0025f0d9655_69123ff959ccd96c1320b4"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: DavidSchinazi
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/I345gXBv5lPuw6nXNFe3Q87YSHQ>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Jun 2019 22:06:44 -0000
@nibanks the issue is that an attacker can close the connection if the stateless reset tokens are the same for different CIDs. Perhaps this wording gets you what you want: ``` An endpoint can request that its peer retire connection IDs by sending a NEW_CONNECTION_ID frame with an increased Retire Prior To field. Upon receipt, the peer SHOULD retire the corresponding connection IDs and send the corresponding RETIRE_CONNECTION_ID frame in a timely manner. Failing to do so can cause packets to be delayed or lost and harm connection performance as the original endpoint might not route those connection IDs optimally after some delay. The sender of the Retire Prior To field MUST keep track of the connection IDs it wishes to retire until it has received a corresponding RETIRE_CONNECTION_ID frame, with one exception: if the sender of the Retire Prior To field has used distinct stateless reset tokens for all of their issued connection IDs, and 3 times the PTO has elapsed since it received an acknowledgment for its Retire Prior To field, then it MAY lose track of that connection ID, and respond to packets with that connection ID with the corresponding stateless reset token. ``` This allows you to implement the enforcement you want while keeping the spec written in such a way that most implementations don't accidentally allow this attack by being overly enthusiastic in enforcing this. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/quicwg/base-drafts/issues/2645#issuecomment-501041204
- [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mike Bishop
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Jana Iyengar
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Jana Iyengar
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Jana Iyengar
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mark Nottingham
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Kazuho Oku
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Kazuho Oku
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Kazuho Oku
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Marten Seemann
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Kazuho Oku
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Martin Thomson
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Kazuho Oku
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Martin Thomson
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mike Bishop
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mike Bishop
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Martin Thomson
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Eric Kinnear
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) ianswett
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) MikkelFJ
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Nick Banks
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) David Schinazi
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mike Bishop
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Mike Bishop
- Re: [quicwg/base-drafts] Retire My Own CID (#2645) Martin Thomson