Re: [quicwg/base-drafts] Prohibit TLS 1.3 middlebox compatibility mode (#3595)

[Kazuho Oku <[e-mail]>]

@marten-seemann 
> Assume that you're not validating the empty legacy_session_id on the server side, how would you prevent the injection of CCS then?

As @martinthomson says, our code that emits ChangeCipherSpec would check if the underlying protocol is the TLS record protocol. If that's something else, a TLS alert is generated. See https://github.com/h2o/picotls/blob/master/lib/picotls.c#L1480-L1484.

@martinthomson 
> You could fall back to a generic TLS alert, like handshake_failure, but the error is really a QUIC one.

I'm not sure if I share that view. We already have certain requirements on how TLS is used, and we use TLS error codes to communicate errors (e.g., use of unexpected_message when a TLS Key Update message is received).

FWIW, the code above in picotls sends unexpected_message (I can change that for sure, I just merged it).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3595#issuecomment-618247412