Date: Fri, 07 Dec 2018 10:15:14 -0800
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4aba3273e33c77fa742fb20b7e790faf0772086b05a92cf0000000118227ab292a169ce16f92d74@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/2064/c445318555@github.com>
In-Reply-To: <quicwg/base-drafts/pull/2064@github.com>
References: <quicwg/base-drafts/pull/2064@github.com>
Subject: Re: [quicwg/base-drafts] Amplification attack using retry tokens and
 spoofed addresses (#2064)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5c0ab8b2e3fe1_44913fd6172d45c4199942";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/RQ9F0auI8O81RPbs7s4nCF7QkLg>


----==_mimepart_5c0ab8b2e3fe1_44913fd6172d45c4199942
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

@marten-seemann 
> I don't a short token life time works as a protection here. I expect servers to issue tokens (in NEW_TOKEN frames) that have the same life time as TLS session tickets, which, if I remember correctly, is a 7 days.

I am not sure if that's correct. IIUC, the reason we split information that are maintained across connections to TLS session tickets and tokens was because they have different properties, including lifetime. Tokens are per-path objects and they should have a short span. If that's not clear, I think we should clarify that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2064#issuecomment-445318555
----==_mimepart_5c0ab8b2e3fe1_44913fd6172d45c4199942
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p><a class=3D"user-mention" data-hovercard-type=3D"user" data-hovercard-=
url=3D"/hovercards?user_id=3D1478487" data-octo-click=3D"hovercard-link-c=
lick" data-octo-dimensions=3D"link_type:self" href=3D"https://github.com/=
marten-seemann">@marten-seemann</a></p>
<blockquote>
<p>I don't a short token life time works as a protection here. I expect s=
ervers to issue tokens (in NEW_TOKEN frames) that have the same life time=
 as TLS session tickets, which, if I remember correctly, is a 7 days.</p>=

</blockquote>
<p>I am not sure if that's correct. IIUC, the reason we split information=
 that are maintained across connections to TLS session tickets and tokens=
 was because they have different properties, including lifetime. Tokens a=
re per-path objects and they should have a short span. If that's not clea=
r, I think we should clarify that.</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/pull/2064#issuecomment-445318555">view it on GitHub</a>, o=
r <a href=3D"https://github.com/notifications/unsubscribe-auth/AWbkqxlizn=
QDK_vd_RlF8PyxQInJiZc2ks5u2rAygaJpZM4Y4UIy">mute the thread</a>.<img src=3D=
"https://github.com/notifications/beacon/AWbkqx5_8MQUcOKa4jPcityPbRHlX2F9=
ks5u2rAygaJpZM4Y4UIy.gif" height=3D"1" width=3D"1" alt=3D"" /></p>
<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_versio=
n":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name"=
:"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"=
quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"http=
s://assets-cdn.github.com/images/email/message_cards/header.png","avatar_=
image_url":"https://assets-cdn.github.com/images/email/message_cards/avat=
ar.png","action":{"name":"Open in GitHub","url":"https://github.com/quicw=
g/base-drafts"}},"updates":{"snippets":[{"icon":"PERSON","message":"@kazu=
ho in #2064: @marten-seemann \r\n\u003e I don't a short token life time w=
orks as a protection here. I expect servers to issue tokens (in NEW_TOKEN=
 frames) that have the same life time as TLS session tickets, which, if I=
 remember correctly, is a 7 days.\r\n\r\nI am not sure if that's correct.=
 IIUC, the reason we split information that are maintained across connect=
ions to TLS session tickets and tokens was because they have different pr=
operties, including lifetime. Tokens are per-path objects and they should=
 have a short span. If that's not clear, I think we should clarify that."=
}],"action":{"name":"View Pull Request","url":"https://github.com/quicwg/=
base-drafts/pull/2064#issuecomment-445318555"}}}</script>
<script type=3D"application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/pull/2064#issuecomment-4=
45318555",
"url": "https://github.com/quicwg/base-drafts/pull/2064#issuecomment-4453=
18555",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
},
{
"@type": "MessageCard",
"@context": "http://schema.org/extensions",
"hideOriginalBody": "false",
"originator": "AF6C5A86-E920-430C-9C59-A73278B5EFEB",
"title": "Re: [quicwg/base-drafts] Amplification attack using retry token=
s and spoofed addresses (#2064)",
"sections": [
{
"text": "",
"activityTitle": "**Kazuho Oku**",
"activityImage": "https://assets-cdn.github.com/images/email/message_card=
s/avatar.png",
"activitySubtitle": "@kazuho",
"facts": [

]
}
],
"potentialAction": [
{
"name": "Add a comment",
"@type": "ActionCard",
"inputs": [
{
"isMultiLine": true,
"@type": "TextInput",
"id": "IssueComment",
"isRequired": false
}
],
"actions": [
{
"name": "Comment",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"IssueComment\",\n\"repositoryFullName\": \=
"quicwg/base-drafts\",\n\"issueId\": 2064,\n\"IssueComment\": \"{{IssueCo=
mment.value}}\"\n}"
}
]
},
{
"name": "Close pull request",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"PullRequestClose\",\n\"repositoryFullName\=
": \"quicwg/base-drafts\",\n\"pullRequestId\": 2064\n}"
},
{
"targets": [
{
"os": "default",
"uri": "https://github.com/quicwg/base-drafts/pull/2064#issuecomment-4453=
18555"
}
],
"@type": "OpenUri",
"name": "View on GitHub"
},
{
"name": "Unsubscribe",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"MuteNotification\",\n\"threadId\": 4174157=
30\n}"
}
],
"themeColor": "26292E"
}
]</script>=

----==_mimepart_5c0ab8b2e3fe1_44913fd6172d45c4199942--