IETF Logo Mail Archive

Re: [quicwg/base-drafts] Add application parameters to QUIC handshake and use it for H3 SETTINGS (#3086)

MikkelFJ <notifications@github.com> Fri, 11 October 2019 05:45 UTC

Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB3D112004C for <quic-issues@ietfa.amsl.com>; Thu, 10 Oct 2019 22:45:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.382
X-Spam-Level:
X-Spam-Status: No, score=-6.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iTw8cClO5liH for <quic-issues@ietfa.amsl.com>; Thu, 10 Oct 2019 22:45:48 -0700 (PDT)
Received: from out-17.smtp.github.com (out-17.smtp.github.com [192.30.252.200]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CC3E12003E for <quic-issues@ietf.org>; Thu, 10 Oct 2019 22:45:48 -0700 (PDT)
Date: Thu, 10 Oct 2019 22:45:47 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1570772747; bh=k+cMKb4V6hEf+KgO5jw5Ck+eCgBFob3J9BfS4dgbINs=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=kWhxLEFysrpkZ+2aBtPJG/mTAlvSsZCP0oF9E/KgWAaYX61XToJJVwjg3+31IvnHA wz8o/ItOE7iG3bXdSHG0AsC0lsNHcJ69NPSF2QCgY+QTeQG+77XdJFAiIsBGudpai+ yPlrs4AFrE0YjkIP0JeBkMbdLzh8yOyQpGYcPk8c=
From: MikkelFJ <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+AFTOJK7OXGAFFWGHM7JFUQN3VVLZXEVBNHHB4IOF7M@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/3086/540917489@github.com>
In-Reply-To: <quicwg/base-drafts/issues/3086@github.com>
References: <quicwg/base-drafts/issues/3086@github.com>
Subject: Re: [quicwg/base-drafts] Add application parameters to QUIC handshake and use it for H3 SETTINGS (#3086)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5da0170b4f04b_189a3f85332cd95c33697b"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: mikkelfj
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address: quic-issues@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/YCjkSkL81Hr5SSm4p84VeLKAjCQ>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Oct 2019 05:45:50 -0000

@nharper I believe you forgot to mention that early settings are not protected which can lead to privacy concerns both in terms of fingerprinting (but it has been argued that this is no worse than what already is), and in terms of actually reading the data. The last part is a concern because we already have problems with host names not being protected properly in the current form. You could encrypt early parameters with a symmetric key that is only learned post handshake, but I'm not sure if you can do this without introducing delays.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3086#issuecomment-540917489

v2.23.0 | Report a Bug | By Email