Re: [quicwg/base-drafts] Fix for off-path migration attack (#2033)

[Kazuho Oku <[e-mail]>]

Thank you for writing down the PR.

I know that this question has been asked before, but do we need PATH_CHALLENGE and PATH_RESPONSE to verify NAT rebinding?

IIUC a client has only one path that can be used for send non-probing packets. Therefore, a server receiving a non-probing packet (with a PN greater than what it has seen before) can be used as a way to determine the current active path.

So to me, it seems that just using PING will be sufficient for the server to verify what the client thinks as the current path. In other words, there is no reason for a _server_ to send PATH_CHALLENGE (and for a client to send PATH_RESPONSE).

The reason I raise the question, even though I understand that the PATH_CHALLENGE / PATH_RESPONSE is nevertheless required for the client to "probe" for a new path, is because removing the requirement for the server to send a challenge / wait for response seems like a simplification (at the cost of increasing asymmetry).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2033#issuecomment-440556206