Re: [quicwg/base-drafts] Authenticating connection IDs (#3439)

[martinduke <[e-mail]>]

After skimming the paper and reading MT's justification a few times, I guess I am still unclear on the threat model:

1) Attacker rewrites the SCID of a Retry Packet. This affects the Initial Keys and can't be protected by the TP. Server acceptance of the provided CID is a pretty good indication it doesn't much care, in which case, meh. If someone picking a CID will take your site down, change the CID!

If we must do something here, perhaps we should just say "servers MUST change their CID if they are sending an ODCID TP?" -- this would make it easier for Google and minimize the change otherwise.

But really the answer is to put in the token. It's the only way to definitively kill the connection if a MITM is messing with us, and solves the Initial-Key problem.

2) Attacker rewrites the SCID of server initial. Doesn't Section 5.2 mean that the server would simply discard the remaining Client packets? Doesn't this obviate the need for the TP? I guess the MITM could successfully rewrite to the original client-chosen DCID, but presumably servers are written to limit the ability of clients or MITMs to just ignore the new CID?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3439#issuecomment-595362807