Re: [quicwg/base-drafts] Document request forgery (#3996)

ianswett <> Sat, 05 September 2020 19:38 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CCF4D3A12B5 for <>; Sat, 5 Sep 2020 12:38:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.1
X-Spam-Status: No, score=-3.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id a6gM3c-JvsOc for <>; Sat, 5 Sep 2020 12:38:19 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5D5283A12B4 for <>; Sat, 5 Sep 2020 12:38:19 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 40B515601E7 for <>; Sat, 5 Sep 2020 12:38:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1599334698; bh=m4P9AEcAQso+oIilW+TwdprGXogyqeuuLG99rxbeLaY=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=QHaiZy6rVDriFjf0lubZSEv/KPHaGvbLxfhvd0VD/iRgVjzbJkHfOcfoie43VO4pU BWyTfdkwK7UOXfEwpAcENeDKKpAeAq3ASh9yu1EdMrqCYT7bjCGcmKXqDsXJgJyIN1 O+PabYvi7uvo9SpN9DxUe5ia5hI4ABwSutDuABC0=
Date: Sat, 05 Sep 2020 12:38:18 -0700
From: ianswett <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3996/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Document request forgery (#3996)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f53e92a2ed00_513c19f0476788"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: ianswett
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 05 Sep 2020 19:38:21 -0000

@ianswett commented on this pull request.

I'm concerned about this new SHOULD NOT, but maybe I'm misunderstanding it?

> +Initial packet protection (Section 5.2 of {{QUIC-TLS}}) makes it difficult for
+servers to control the content of Initial packets sent by clients. A client
+choosing an unpredictable Destination Connection ID ensures that servers are
+unable to control any of the encrypted portion of Initial packets from clients.
+However, the Token field is open to server control and does allow a server to
+use clients to mount request forgery attacks. Use of tokens provided with the
+NEW_TOKEN frame ({{validate-future}}) offers the only option for request
+forgery during connection establishment.
+Clients however are not obligated to use the NEW_TOKEN frame. Request forgery
+attacks that rely on the Token field can be avoided if clients send an empty
+Token field when the server address has changed from when the NEW_TOKEN frame
+was received.
+Therefore, clients SHOULD NOT send a token received in a NEW_TOKEN frame from

To clarify, the NEW_TOKEN frame is not received from a server in an Initial packet, correct?  The first few times I read this, I though that was what you intended.

Assuming I'm now reading this correctly, this SHOULD NOT would seem to be very restrictive for domains which use DNS to load balance traffic.  Previously, I assumed that NEW_TOKEN would be used whenever hostnames matched.  Am I understanding correctly?

If we're going to add this normative restriction, I would suggest placing the restriction in the section on address validation/etc and then referencing this section.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: