Re: [quicwg/base-drafts] Stateless Reset during Path Migration (#1259)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> @@ -1485,6 +1485,13 @@ path validation with other frames.  For instance, an endpoint may pad a packet
 carrying a PATH_CHALLENGE for PMTU discovery, or an endpoint may bundle a
 PATH_RESPONSE with its own PATH_CHALLENGE.
 
+Differences in routing on the Internet might cause the same destination address
+and connection ID to reach a different server instance which does not possess
+the necessary connection state. Receiving a Stateless Reset in response to a

May I question if it is a good idea to let a different server (that does not know the connection state) send a Stateless Reset?

My understanding is that the static key that is used to generate stateless reset tokens cannot be shared between endpoints that do not share the connection states. The attack (credit goes to @siyengar) is as follows.

Consider the case where we have two different servers A and B that do not share the connection state but shares the static key that is being used to generate the stateless reset tokens.

An on-path attacker wants to kill a connection that goes to A. The attacker creates a packet that carries the same CID as the connection he/she wants to kill, and send it to server B. Server B returns a stateless reset. The attacker then forwards the stateless reset to the client and the connection gets reset.

To summarize, I believe that you can send a stateless reset only from a server that knows (or should have known) the connection state.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1259#pullrequestreview-110241523