Re: [quicwg/base-drafts] Revise text on ACK frames prior to handshake completion (#719)

[ianswett <[e-mail]>]

ianswett commented on this pull request.

A few suggestions to make the wording stronger.

> -ISSUE:
-
-: What about 0-RTT data?  Should we allow acknowledgment of 0-RTT with
-  unprotected frames?  If we don't, then 0-RTT data will be unacknowledged until
-  the handshake completes.  This isn't a problem if the handshake completes
-  without loss, but it could mean that 0-RTT stalls when a handshake packet
-  disappears for any reason.
-
-An endpoint SHOULD use data from unprotected or 0-RTT-protected `ACK` frames
-only during the initial handshake and while they have insufficient information
-from 1-RTT-protected `ACK` frames.  Once sufficient information has been
-obtained from protected messages, information obtained from less reliable
-sources can be discarded.
+Endpoints MUST NOT use an `ACK` frame in an unprotected packet to acknowledge
+packets that were protected by 0-RTT or 1-RTT keys.  An endpoint MUST ignore an
+`ACK` frame in an unprotected packet if it claims to acknowledge data that was

So the endpoint needs to ignore the entire ack frame if any packets acknowledged were protected?

> +packets that were protected by 0-RTT or 1-RTT keys.  An endpoint MUST ignore an
+`ACK` frame in an unprotected packet if it claims to acknowledge data that was
+sent in a protected packet.  Such an acknowledgement can only serve as a denial
+of service, since an endpoint that can read protected data is always able to
+send protected data.
+
+Note:
+
+: 0-RTT data can be acknowledged by the server as it receives it, but any
+  packets containing acknowledgments of 0-RTT data cannot have packet protection
+  removed by the client until the entire server handshake is received by the
+  client.
+
+An endpoint SHOULD use data from `ACK` frames carried in unprotected or
+0-RTT-protected packets only during the initial handshake and while they have
+insufficient information from `ACK` frames in 1-RTT-protected packets.  Once

I'd like to make this stronger if possible.  How about "only before they have received an 'ACK' frame in a 1-RTT protected packet.  Once they have received an ack frame in a 1-RTT protected packet, all ack frames with less protection MUST be ignored."

> -
-An endpoint SHOULD use data from unprotected or 0-RTT-protected `ACK` frames
-only during the initial handshake and while they have insufficient information
-from 1-RTT-protected `ACK` frames.  Once sufficient information has been
-obtained from protected messages, information obtained from less reliable
-sources can be discarded.
+Endpoints MUST NOT use an `ACK` frame in an unprotected packet to acknowledge
+packets that were protected by 0-RTT or 1-RTT keys.  An endpoint MUST ignore an
+`ACK` frame in an unprotected packet if it claims to acknowledge data that was
+sent in a protected packet.  Such an acknowledgement can only serve as a denial
+of service, since an endpoint that can read protected data is always able to
+send protected data.
+
+Note:
+
+: 0-RTT data can be acknowledged by the server as it receives it, but any

I'm not sure how this note is helpful.  The server has to send all acks either unprotected or in 1RTT packets, correct?  If so, it seems simpler to say "0-RTT data can be acknowledged by the server as it is received, but it must be send with 1-RTT protection."?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/719#pullrequestreview-55420770