Re: [quicwg/base-drafts] Padding overhead in DNS over QUIC scenarios (#3523)

[Christian Huitema <[e-mail]>]

@mikkelfj Yes, servers should have ways to ban token reuse. There is already a recommendation that "A client SHOULD NOT reuse a NEW_TOKEN token for different connection attempts." I think we should add text saying that "A server that detects NEW_TOKEN reuse MAY immediately close (Section 10.3) the connection with an INVALID_TOKEN error."

It would be even better if the NEW_TOKEN frame carried an expected DCID parameter. This would make handling of new tokens by server very similar to handling of retry token: refuse or drop if the incoming DCID does not match the value tied to the token. It would also make reuse detection very easy, because connections attempts from the same address and to the same DCID could be routed to the same connection context. Only one connection would be accepted for the duration of the draining delay, which would greatly limit the possibility of abuse.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3523#issuecomment-599073854