Re: [quicwg/base-drafts] Allow most frames in 0-RTT (#2355)

[Mike Bishop <[e-mail]>]

MikeBishop approved this pull request.

I'm okay with the text as it stands, but had a few things to consider.

> @@ -324,19 +324,15 @@ the connection can usually appear at any encryption level, whereas those
 associated with transferring data can only appear in the 0-RTT and 1-RTT
 encryption levels:

The beginning of this paragraph (which GitHub won't let me comment on) is no longer true -- there isn't a specific list of frames per encryption level, but a list of exceptions to a general rule.

> +MUST describe how the protocol uses 0-RTT and the measures that are employed to
+protect against replay attack.  Disabling 0-RTT entirely is the most effective
+strategy.
+
+In the core protocol, particular attention needs to be paid to STREAM frames,
+which carry application data.  If another frame type carries, or could carry,
+application semantics, then the risk from replay attack needs to be considered.
+For instance, though this is likely to be inadvisable, an application that
+attached semantics to increases in flow control credit or stream cancellation
+would need to assess whether those uses were vulnerable to replay attack.
+
+Extensions to QUIC might create an additional exposure to replay attack if they
+are used by application protocols.  QUIC extensions SHOULD describe how replay
+attacks affects their operation.  Application protocols MUST either disable
+extensions in 0-RTT or provide replay mitigation strategies for any use of the
+extension.

This last sentence feels a little weird.  The application protocol is responsible for rules about transport extensions?  I would expect to be able to add support for new extensions to a transport library without needing to rev the application layer, unless the extension is explicitly used by the application layer.

It seems like the requirement that extensions describe how replay attacks are mitigated would be sufficient in general, and scope that last requirement to extensions which carry explicit application semantics (e.g. DATAGRAM).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2355#pullrequestreview-202914936