Re: [quicwg/base-drafts] Do Initial secrets change after Retry packet? (#2823)

[Kazuho Oku <[e-mail]>]

Reading @martinthomson's comment on https://github.com/quicwg/base-drafts/issues/3014#issuecomment-535016758, I think that the computation cost of mounting a DoS attack would change if we are to retain the original Initial secrets after Retry, as proposed in #2878.

In the current design, a server can use Retry packets to enforce clients to do equal amount of HKDF extractions, as the CIDs found in Retry packets update the Initial secrets. However, if we adopt #2878, the clients will given the freedom to choose the Initial key regardless of if Retry is used.

That might open new attack vectors.

For example, a DDoS attacker might send Initial packets that carry the same DCID (or a small set of DCIDs) from multiple addresses, receive Retry tokens, then send back Initial packets carrying the correct tokens and CIDs. The clients can use the precomputed Initial secrets when sending back the Initial packets, the client.

I am not sure how important this kind of attack is, but I think we need to make sure that the change of computation cost is OK.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-536161181