Date: Wed, 06 Feb 2019 11:49:17 -0800
From: Mike Bishop <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4abd5fc15af438a32210be1ae22f328cdd099a6b8a992cf000000011872fc3d92a169ce183ba2c6@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2413/461162070@github.com>
In-Reply-To: <quicwg/base-drafts/issues/2413@github.com>
References: <quicwg/base-drafts/issues/2413@github.com>
Subject: Re: [quicwg/base-drafts] Mandate using a new connection ID on
 migration (#2413)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5c5b3a3d50bd9_58823fa5748d45c4697898";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/h1k-VmMUq6r3MZULWcPovmPCXCw>


----==_mimepart_5c5b3a3d50bd9_58823fa5748d45c4697898
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

The problem with migrating with an empty CID is that the recipient can't identify which connection it should be considered for.  It's going to have to do trial decryption with the keys for all current 0LCID connections on that destination port if it wants to permit that.  (In fact, I'm fairly sure we previously had text that said if you couldn't match a packet to exactly one connection upon receipt, you had to drop it; that seems to have been removed.)  On a NAT rebinding, a server could say that if the IP matches and only the port has changed, it might still match a singular existing connection.

That's only safe if the server is using a unique port for each connection, which seems unlikely.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2413#issuecomment-461162070
----==_mimepart_5c5b3a3d50bd9_58823fa5748d45c4697898
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p>The problem with migrating with an empty CID is that the recipient can=
't identify which connection it should be considered for.  It's going to =
have to do trial decryption with the keys for all current 0LCID connectio=
ns on that destination port if it wants to permit that.  (In fact, I'm fa=
irly sure we previously had text that said if you couldn't match a packet=
 to exactly one connection upon receipt, you had to drop it; that seems t=
o have been removed.)  On a NAT rebinding, a server could say that if the=
 IP matches and only the port has changed, it might still match a singula=
r existing connection.</p>
<p>That's only safe if the server is using a unique port for each connect=
ion, which seems unlikely.</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/issues/2413#issuecomment-461162070">view it on GitHub</a>,=
 or <a href=3D"https://github.com/notifications/unsubscribe-auth/AWbkq1UY=
G5n5bZPB-UjRADrL7JRKGPbmks5vKzG9gaJpZM4aiOuh">mute the thread</a>.<img sr=
c=3D"https://github.com/notifications/beacon/AWbkqy4-t6qOT71jLd0M_-Caa6yu=
XMJnks5vKzG9gaJpZM4aiOuh.gif" height=3D"1" width=3D"1" alt=3D"" /></p>
<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_versio=
n":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name"=
:"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"=
quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"http=
s://github.githubassets.com/images/email/message_cards/header.png","avata=
r_image_url":"https://github.githubassets.com/images/email/message_cards/=
avatar.png","action":{"name":"Open in GitHub","url":"https://github.com/q=
uicwg/base-drafts"}},"updates":{"snippets":[{"icon":"PERSON","message":"@=
MikeBishop in #2413: The problem with migrating with an empty CID is that=
 the recipient can't identify which connection it should be considered fo=
r.  It's going to have to do trial decryption with the keys for all curre=
nt 0LCID connections on that destination port if it wants to permit that.=
  (In fact, I'm fairly sure we previously had text that said if you could=
n't match a packet to exactly one connection upon receipt, you had to dro=
p it; that seems to have been removed.)  On a NAT rebinding, a server cou=
ld say that if the IP matches and only the port has changed, it might sti=
ll match a singular existing connection.\r\n\r\nThat's only safe if the s=
erver is using a unique port for each connection, which seems unlikely."}=
],"action":{"name":"View Issue","url":"https://github.com/quicwg/base-dra=
fts/issues/2413#issuecomment-461162070"}}}</script>
<script type=3D"application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/2413#issuecomment=
-461162070",
"url": "https://github.com/quicwg/base-drafts/issues/2413#issuecomment-46=
1162070",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>=

----==_mimepart_5c5b3a3d50bd9_58823fa5748d45c4697898--