Date: Sun, 24 May 2020 04:12:00 -0700
From: Marten Seemann <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+AFTOJKZY3B6CZ2SX4ZOHC4542Y3YBEVBNHHCKKTHGI@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/3690/633214965@github.com>
In-Reply-To: <quicwg/base-drafts/issues/3690@github.com>
References: <quicwg/base-drafts/issues/3690@github.com>
Subject: Re: [quicwg/base-drafts] How to reject a connection attempt (#3690)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5eca56803d9dc_3143fcfd70cd9601969535";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/gGVtlzOTq3pHeuF_7ai8DvEyMUY>


----==_mimepart_5eca56803d9dc_3143fcfd70cd9601969535
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

> In case of this example, CONNECTION_REFUSED would become an attractive tool for MITM attackers, because it can be used for preventing the client for reconnecting for as long as a day or a week.

We accept this risk in QUIC v1. Removing error codes to mitigate the MITM vulnerability seems like a piecemeal "solution" to a problem that can only be solved by decent cryptography.

For the MITM the easiest way is probably injection a Version Negotiation packet that indicates that there are no compatible versions between the client and the server. I'd expect most client implementations to give up a dial attempt in this case, which in effect would be very similar to the actions taken in response to a CONNECTION_REFUSED.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3690#issuecomment-633214965
----==_mimepart_5eca56803d9dc_3143fcfd70cd9601969535
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p></p>
<blockquote>
<p>In case of this example, CONNECTION_REFUSED would become an attractive tool for MITM attackers, because it can be used for preventing the client for reconnecting for as long as a day or a week.</p>
</blockquote>
<p>We accept this risk in QUIC v1. Removing error codes to mitigate the MITM vulnerability seems like a piecemeal "solution" to a problem that can only be solved by decent cryptography.</p>
<p>For the MITM the easiest way is probably injection a Version Negotiation packet that indicates that there are no compatible versions between the client and the server. I'd expect most client implementations to give up a dial attempt in this case, which in effect would be very similar to the actions taken in response to a CONNECTION_REFUSED.</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/issues/3690#issuecomment-633214965">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AFTOJK6ADV2QHHZF25HGQVTRTD6IBANCNFSM4NIGTQSA">unsubscribe</a>.<img src="https://github.com/notifications/beacon/AFTOJK74LE4QKLS3HLJBW6TRTD6IBA5CNFSM4NIGTQSKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEW7BP5I.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/3690#issuecomment-633214965",
"url": "https://github.com/quicwg/base-drafts/issues/3690#issuecomment-633214965",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5eca56803d9dc_3143fcfd70cd9601969535--