Re: [quicwg/base-drafts] handling of coalesced packets with decryption errors creates DoS opportunity (#2308)

[Kazuho Oku <[e-mail]>]

> However, if the keys are available, and decryption fails, this means that the peer sent an invalid packet (or that we're dealing with an on-path attacker, which we can't do anything against anyway).

Doesn't decryption failure happen also when the packet gets corrupt while being transmitted? 

Consider a coalesced packet sent by client that contains Initial (for ACKing ServerHello) and a Handshake packet. I'd assume that we'd prefer processing Handshake packet even if Initial was corrupt.

> Since it's possible to coalesce about 70 QUIC packets into a single 1200 byte datagram, an attacker could cause a peer to attempt 70 AEAD operations with a single datagram.

Does that matter, considering the fact that an attacker can force AEAD operation for every 21 bytes by using a short header packet (1 type + 4 byte space + 16 byte AEAD tag)?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2308#issuecomment-451820314