[quicwg/base-drafts] 595808: Expand the anti-replay story

Martin Thomson <martin.thomson@gmail.com> Mon, 21 January 2019 22:20 UTC

Sender: martin.thomson=gmail.com@github.com
Date: Mon, 21 Jan 2019 14:20:39 -0800
From: Martin Thomson <martin.thomson@gmail.com>
Reply-To: Martin Thomson <martin.thomson@gmail.com>
To: quic-issues@ietf.org
Message-ID: <5c4645b77b17c_4f592abea117057c454cf@hookshot-fe-da92815.cp1-iad.github.net.mail>
Subject: [quicwg/base-drafts] 595808: Expand the anti-replay story
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="--==_mimepart_5c4645b77adad_4f592abea117057c453f7"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/LcrQukGPeG1DtNb98iLhGPJaObw>
Precedence: list

  Branch: refs/heads/0rtt-reset
  Home:   https://github.com/quicwg/base-drafts
  Commit: 59580812145936f7089586212155f14f4495d49f
      https://github.com/quicwg/base-drafts/commit/59580812145936f7089586212155f14f4495d49f
  Author: Martin Thomson <martin.thomson@gmail.com>
  Date:   2019-01-22 (Tue, 22 Jan 2019)

  Changed paths:
    M draft-ietf-quic-http.md
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Expand the anti-replay story

The inclusion of RESET_STREAM (and all other frame types) in 0-RTT
inspired me to do some more analysis and due diligence on anti-replay.

This adds a security considerations section with requirements for
application protocols.  That section explains more about what the risks
for QUIC are, how QUIC itself isn't affected, but how an application
protocol might be.

It also adds a section to the HTTP draft citing RFC 8470, explaining how
that analysis is sufficient for HTTP/3.



      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.

[quicwg/base-drafts] 595808: Expand the anti-repl… Martin Thomson