Re: [quicwg/base-drafts] token-based greasing / initial packet protection (#3166)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> +NEW_TOKEN frame, the server generates the alternative initial salt by calling a
+pseudo-random function, embeds that initial salt into the token which is then
+encrypted, and sends a NEW_TOKEN frame that comprises of the generated token and
+the alternative initial set.
+
+When the client reconnects to the server by using the provided token and the
+alternative initial set, the server first checks if the version number field of
+the incoming packet contains one of the alternative version numbers it
+advertises, then if that is the case, applies the corresponding packet type
+modifier to recover the correct packet type.  If the recovered packet type is an
+Initial packet and that packet contains a NEW_TOKEN token, the server decrypts
+the embedded token and recovers the alternative initial salt, uses that to
+decrypt the payload of the Initial packet.
+
+When the server is incapable of determining the alternative initial salt, it can
+send a Version Negotiation packet that instructs the client to use the default

@DavidSchinazi That's obviously the case. Thank you for pointing that out.

I think what the PR fails to state that a Retry token needs to inherit the properties of the NEW_TOKEN token included in the Initial packet that trigerred the Retry. One way doing that is to embed the NEW_TOKEN token in the Retry token.

The reason why we need the NEW_TOKEN token to be embedded in the Retry token is not only because there is an attack that you describe. It is necessary because when the server receives the first Initial packet from client that carries the alternative version, and responds with a Retry packet that carries that alternative version, and the client in response sends an Initial packet that carries the Retry token using an Initial packet with the alternative version, the server needs to extract the alternative initial salt (and other information) from the Retry token.

I'd update the PR to clarify that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3166#discussion_r340396154