Re: [quicwg/base-drafts] Initial secrets do not change after Retry (#2878)

[Marten Seemann <[e-mail]>]

marten-seemann requested changes on this pull request.

At the NY interim, we agreed that a design goal of QUIC's Retry mechanism is that a MITM is not able to perform a Retry. 
By removing the original_connection_id transport parameter, this PR reintroduces that option. The attack works as follows:
1. The MITM captures the Initial packet, and sends a Retry packet. 
2. The client generates a second Initial as a response. This packet will us the DCID provided by the Retry (which is different from the DCID use for the first Initial).
3. The MITM strips out the token, and re-protects the packet with an Initial key derived from the DCID of the packet (it might even choose to change the DCID before forwarding the packet to the server).
4. Because the key used to protect the packet was derived from the DCID, the server is able to unprotect the packet. It replies with an Initial packet.
5. Since Initials are able to change the DCID, the client will accept the Initial packet and change the DCID again (if MITM or server changed the DCID, that is).



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#pullrequestreview-259275439