Re: [quicwg/base-drafts] Amplification attack using retry tokens and spoofed addresses (#2064)

[Marten Seemann <[e-mail]>]

@huitema @janaiyengar As I described in https://github.com/quicwg/base-drafts/pull/2064#issuecomment-443087560, I don't a short token life time works as a protection here. I expect servers to issue tokens (in NEW_TOKEN frames) that have the same life time as TLS session tickets, which, if I remember correctly, is a 7 days.

The property we're really looking for here is not that a token is only used once. To prevent the DoS attacks, it would be sufficient if the server only accepts a token once **within a short time span**, let's say in the order of magnitude of 10 seconds.
If an attacker manages to obtain a copy of a token that was originally sent in a NEW_TOKEN frame, all he can do is make the server send the ServerHello and the certificate to the client every 10 seconds, which might be an annoyance, but not sufficient for a DoS attack.

I believe this is should be straightforward to implement: A server could either keep a short-lived set of tokens that were recently used, or maybe even a bloom filter which is cleared in regular intervals.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2064#issuecomment-445257931