Re: [quicwg/base-drafts] Add retry integrity tag (#3120)

[Christian Huitema <[e-mail]>]

huitema commented on this pull request.



> +The Retry Pseudo-Packet is not sent over the wire. It is computed by taking
+the transmitted Retry packet, removing the Retry Integrity Tag and prepending
+the two following fields:
+
+ODCID Len:
+
+: The ODCID Len contains the length in bytes of the Original Destination
+  Connection ID field that follows it, encoded as an 8-bit unsigned integer.
+
+Original Destination Connection ID:
+
+: The Original Destination Connection ID contains the value of the Destination
+  Connection ID from the Initial packet that this Retry is in response to. The
+  length of this field is given in ODCID Len. The presence of this field
+  mitigates an off-path attacker's ability to inject a Retry packet.
+

If the off-path attacker has not seen the client's initial packet, it cannot set the DCID of the Retry to the SCID of the client's Initial, which means the Retry would be rejected by the client already.

The additional protection is only effective if the client uses predictable CID, e.g. zero length -- but that's a truly bad idea for a variety of reasons. Such clients would be exposed to other attacks, e.g. injecting random bytes in the crypto-stream.

So in practice, the retry attack is only effective if the attacker is "in the middle" or "on the side". And the checksum will not protect against that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3120#discussion_r346680010