Subject: Re: [quicwg/base-drafts] Amplification attack using retry tokens and spoofed addresses (#2064)
From: Kazuho Oku <[email-masked]>
To: quicwg/base-drafts <[email-masked]>
Cc: Subscribed <[email-masked]>
Date: Fri, 07 Dec 2018 10:15:14 -0800
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>

@marten-seemann 
> I don't a short token life time works as a protection here. I expect servers to issue tokens (in NEW_TOKEN frames) that have the same life time as TLS session tickets, which, if I remember correctly, is a 7 days.

I am not sure if that's correct. IIUC, the reason we split information that are maintained across connections to TLS session tickets and tokens was because they have different properties, including lifetime. Tokens are per-path objects and they should have a short span. If that's not clear, I think we should clarify that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2064#issuecomment-445318555