Re: [quicwg/base-drafts] Authenticate connection IDs (#3499)

[martinduke <[e-mail]>]

martinduke requested changes on this pull request.

Thanks to @martinthomson and @dschinazi for making it clear this is about security proofs, not specific attacks. I'm more inclined to support it now.

If there is really no path to proving that the spec already authenticates server initial SCIDs, then this may be the price we have to pay to be provably secure. The Retry parts may be necessary in any case.

But it's a pain. Clients keeping up to 3 different peer CIDs at one time in the handshake; longer retry tokens; and a bunch of mandatory TPs, changing on a per-connection basis, with no observable purpose. It feels like bloat but I don't have the tools and resources to prove it.

> @@ -4742,6 +4781,22 @@ active_connection_id_limit (0x0e):
   When a zero-length connection ID is being used, the active_connection_id_limit
   parameter MUST NOT be sent.
 
+handshake_connection_id (0x0f):
+
+: The value that the endpoint included in the Source Connection ID field of the
+  first Initial packet it sends during the handshake. Endpoints MUST validate
+  that this transport parameter is present and that it matches the value that
+  was received in Initial packets. Authenticating this value ensures that an
+  attacker is unable to influence the selection of connection IDs during the

What if some of these CIDs are zero length? Do we omit them?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3499#pullrequestreview-372441388