Re: [quicwg/base-drafts] Add Security Considerations for SRT hash collision attack (#3005)

[Jana Iyengar <[e-mail]>]

janaiyengar commented on this pull request.



> @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
 ID can be selected to route later packets to the same server.
 
 
+## Hash Collision Attack on Stateless Reset Tokens
+
+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD

```suggestion
Since stateless reset tokens are generated by peers, endpoints SHOULD
```

> @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
 ID can be selected to route later packets to the same server.
 
 
+## Hash Collision Attack on Stateless Reset Tokens
+
+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD
+be resistant to hash flooding DoS attacks when using a hash map for retaining

Is there an easy reference that can be cited for "hash flooding DoS attacks"?

> @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
 ID can be selected to route later packets to the same server.
 
 
+## Hash Collision Attack on Stateless Reset Tokens
+
+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD
+be resistant to hash flooding DoS attacks when using a hash map for retaining

```suggestion
be resistant to hash flooding DoS attacks when using a hash map for storing and comparing
```

> @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
 ID can be selected to route later packets to the same server.
 
 
+## Hash Collision Attack on Stateless Reset Tokens
+
+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD
+be resistant to hash flooding DoS attacks when using a hash map for retaining
+those tokens. One way of achieving such property is to retain and compare the

```suggestion
those tokens. One way of achieving this property is to store and compare
```

> @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
 ID can be selected to route later packets to the same server.
 
 
+## Hash Collision Attack on Stateless Reset Tokens
+
+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD
+be resistant to hash flooding DoS attacks when using a hash map for retaining
+those tokens. One way of achieving such property is to retain and compare the
+transformed values of the stateless tokens where the transformation is defined
+as a pseudo-random permutation (e.g., block cipher) or a keyed hash (e.g., HMAC
+{{?RFC2104}}) that is cryptographically secure, instead of using the raw token
+values as the hash keys.  This approach satisfies the secure comparison

Suggested rephrase: "... transformed values of the stateless tokens instead of the raw token values. A transformation such as a pseudo-random permutation (e.g. block cipher) or a cryptographically-secure keyed hash (e.g., HMAC {{?RFC2104}}) can be used to also ensure that comparing stateless tokens does not leak timing information, as specified in {{detect-stateless-reset}}."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3005#pullrequestreview-283653099