Re: [quicwg/base-drafts] Handling of corrupt Retry packets (#3014)

[Kazuho Oku <[e-mail]>]

> I'd like something more concrete than "this is expensive", but I'm willing to concede that this is a considerable increase in cost for a DoS protection device.

I share the same view. We have discussed this previously, and the conclusion was to not apply AEAD to the Retry packets. I think this issue warrants us the chance to revisit the previous conclusion, but I think it's worth wondering if we can find a solution without enforcing the use of AEAD.

That's why I am suggesting the use of optional GMAC. The straw-man is as follows.

When a client receives a Retry packet, it checks the last 16 bytes of the packet. If the last 16 bytes are equal to the original DCID, the packet is considered to be _not_ protected by the AEAD. The token is the rest of the packet payload. If the last 16 bytes is anything else, the packet is considered to be protected by the AEAD. The requirement to the server would be that it should either AEAD-protect the Retry packet, or use the UDP checksum.

There would no longer be a ODCID field.

I think this straw-man might be somewhat better than the "worst" of the two approach being combined, and that it might be something that we can go with.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3014#issuecomment-535022144