Re: [quicwg/base-drafts] Mandatory distinction between token types (#3128)

[ianswett <[e-mail]>]

ianswett approved this pull request.

Some small suggestions, but LG

>  Unlike the token that is created for a Retry packet, there might be some time
 between when the token is created and when the token is subsequently used.
 Thus, a token SHOULD have an expiration time, which could be either an explicit
 expiration time or an issued timestamp that can be used to dynamically calculate
 the expiration time.  A server can store the expiration time or include it in an
 encrypted form in the token.
 
+A token issued with NEW_TOKEN MUST NOT include information that would allow
+values to be linked by an on-path observer to the connection on which it was
+issued.  For example, it cannot include the connection ID or addressing

```suggestion
issued.  For example, it cannot include the previous connection ID or addressing
```

>  
-A client SHOULD NOT reuse a token in different connections.  Reusing a token
-allows connections to be linked by entities on the network path; see
+A client SHOULD NOT reuse a token for different connection attempts.  Reusing a

```suggestion
A client SHOULD NOT reuse a NEW_TOKEN token for different connection attempts.  Reusing a
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3128#pullrequestreview-305207006