Re: [quicwg/base-drafts] Can a client send 0-RTT data when receiving Retry? (#1507)

[MikkelFJ <[e-mail]>]

A 0-RTT retry probably should mean try again with a 1-RTT if it should at
all respond to retry because as Martin already pointed out, a redirected
server likely won’t have the keys whether an endpoint or a middlebox
triggers the retry.

DoS considerations:

You could argue that a dump middle issuing retries under DoS attack might
inadvertently redirect 0-RTT instead of letting it through. Under DoS a
0-RTT handshake could be a way to let priority traffic through.

It might, however, also be that a DoS attack could drain resources be
sending many invalid 0-RTT packets. So the DoS argument isn’t entirely
clear cut.

Attacks in the opposite direction are also possible by man-on-the-side by
sending false retries to the client which could prevent a 0-RTT priority
client from getting through.

Another consideration is to have 0-RTT specific non-stateless retry - I’m
not sure about TLS here - it could be it already supports  that - and it
ties in with servers preferred address which I’m also not up to speed with.

On 2 July 2018 at 14.55.53, ekr ([e-mail]) wrote:

The point is that if the handshake is successful, then the ClientHello and
all the 0-RTT have the same destination connection ID, so they probably end
up at the same point. Add Retry and they might not.

Huh? If you do Retry, you resend initial and this includes resending CH and
0-RTT.

I think that the TLS analogy is fine. In TLS, a server could want a
different key share, but find the PSK perfectly adequate for the purposes
of 0-RTT. There's no reason a server that sends HelloRetryRequest would
need to stop accepting 0-RTT.

Yes, of course, but that creates complexity in the TLS state machine
because of the way CH and HRR are intertwined. That is not so for Retry.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<https://github.com/quicwg/base-drafts/issues/1507#issuecomment-401795136>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AALzN2V8KH-ojf_bpuTvVu1CrPRG09Urks5uChhZgaJpZM4U9xPP>
.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1507#issuecomment-401801284