Re: [quicwg/base-drafts] Document request forgery (#3996)

Lucas Pardue <> Thu, 13 August 2020 14:57 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9E0193A0CA4 for <>; Thu, 13 Aug 2020 07:57:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.097
X-Spam-Status: No, score=-3.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 8RIBt0DmttkF for <>; Thu, 13 Aug 2020 07:57:42 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 41C303A0CBE for <>; Thu, 13 Aug 2020 07:57:42 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 99B4A7A0082 for <>; Thu, 13 Aug 2020 07:57:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1597330661; bh=dCuiljcYK6iJ1C+DtUqQfU/b+SGSUqMr3H2MeVuOsd0=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=VimGP1GI7ErPMtLhLYi8O8JonIKP4kShzBitG9b0kOJHirEcg7cg2XNTQq7pENfAj BrTOZPBpGMGMJya0o7o9ftpZrS6S5vDccnq+Iluqsx7+99GWfEChLvz0k6Qe26rEMZ Xxa54YChAW4PlgJhxgHNDiq3dA0zpJQF3SXTYsUw=
Date: Thu, 13 Aug 2020 07:57:41 -0700
From: Lucas Pardue <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3996/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Document request forgery (#3996)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f3554e5504cb_3f6716f8437574"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: LPardue
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 13 Aug 2020 14:57:44 -0000

@LPardue commented on this pull request.

> +  to use source address spoofing to select where a server sends subsequent
+  datagrams.
+These three options all involve cases where an endpoint sends datagrams to a
+host that might not understand QUIC. That is, these packets are sent prior to
+address validation; see {{address-validation}}.
+Outside of the encrypted portion of packets, QUIC offers an endpoint several
+options for controlling the content of UDP datagrams that a peer sends. The
+Destination Connection ID field offers direct control over early bytes of every
+packet sent by a peer; see {{connection-id}}. The Token field in Initial
+packets offers a server control over other bytes of Initial packets; see
+There are no measures in the protocol to prevent indirect control over the
+encrypted portions of packets. it is necessary to assume that endpoints are

encrypted portions of packets. It is necessary to assume that endpoints are

> +Unlike other packets, packet protection provides good protection against
+control over the contents of Initial packets. The choice of an unpredictable
+Destination Connection ID by clients ensures that servers are unable to control
+any of the encryption portion of Initial packets.

This para's grammar hurts my head. Alternative might be

"Initial packet protection provides resilience to control of contents by servers. Client choice of an unpredictable Destination Connection ID ensures servers are unable to control any of the encrypted portion of Initial packets."

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: