Re: [quicwg/base-drafts] Spoofed retry token attack on IP authentication (#2394)

Kazuho Oku <> Fri, 01 February 2019 12:32 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id B49E1127133 for <>; Fri, 1 Feb 2019 04:32:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -12.552
X-Spam-Status: No, score=-12.552 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id aByfC4zzEuXP for <>; Fri, 1 Feb 2019 04:32:24 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 031DC126C7E for <>; Fri, 1 Feb 2019 04:32:24 -0800 (PST)
Date: Fri, 01 Feb 2019 04:32:22 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1549024342; bh=bNOk+0Pe/hTSXKQky4jfeD+XEGUzvtg0qQ6srYUbVPI=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=lxIu0QDuIgQoXWeQDzR/L3o/pK8btzyJ7pVIOuI6wrjAeJ9CRz3sO5TG7T2unNM5L mQhDx+lQdZmbEC4DeHIi77xRbor3AWPOs9mnC2ofFBM+LFwlllB2Wtes5UMInETjnc gXpR/e9ehTFyaQvrCqLV69dUhl4kF+HbahzbPzjk=
From: Kazuho Oku <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/issues/2394/>
In-Reply-To: <quicwg/base-drafts/issues/>
References: <quicwg/base-drafts/issues/>
Subject: Re: [quicwg/base-drafts] Spoofed retry token attack on IP authentication (#2394)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5c543c56eff04_503a3fe6168d45b498077"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: kazuho
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 01 Feb 2019 12:32:26 -0000

> to add to the vulnerably section that a server SHOULD/MUST not grant privileged access based on the clients IP address verified by a Retry token since on-path devices and also path observing devices can race a Retry packet with a spoofed IP address.

I disagree, because a node that can receive packets going to address X and that can also send a packet that states to originate from X can initiate a new connection by itself.

For such a node, there is no need to piggyback on an Initial sent by the true owner of address X.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: