[quicwg/base-drafts] Invariants does not support public signatures on version negotiation (#1246)

[MikkelFJ <[e-mail]>]

Invariants do not allow for future public signatures on the version negotation packet.

Specific versions can of course add their packets, but it would be better if the version negation packet had room for a signature that future versions could evaluate.
Doing this later in the handshake reduces the defense against handshake attacks from man-on-the-side.

The connection ID swaps the source and destination in the server transmitted vneg packet. This adds a reasonable defense against off-path attacks but makes it impossible to use the source ID for a server signature.

A simple solution would be allow the server to replace part of the source id with a public signature while preservering at least 64 octests from the client. This leaves 144 - 64 = 80 octets for a public signature. Ed25519 signatures are 64 octets - which then leaves room for an additional 80 - 64 = 16 octest for a public key identifier. Ed25519 might turn out to be weak and longer signatures would then be required. Therefore an alternative propososal would be to allow a server to append a signture after the version list. This requires a length field at the start of the version list.

NOTE: the algorithm should be left unspecified - but reserving 80 octets would allow future versions some room.

I would prefer adding a length field and allow for future data.

Quote invariant draft 01: 

>  Version Negotiation packets do not use integrity or confidentiality
   protection.  A specific QUIC version might authenticate the packet as
   part of its connection establishment process.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1246