Re: [quicwg/base-drafts] Server Initial verification for Attacker On The Side defense (#2097)

[MikkelFJ <[e-mail]>]

The first scenario can be attacked all the way up to point 8. certificate validation because an attacker seeing only client messages can create its own handshake key that competes with the server. The client will have to process all alternative handshake keys and alternative SCID values until one handshake passes certificate validation.

The second scenario with server token is not an improvement since the attacker can just provide it own fully valid ServerHello with a token. It will also eventually fail certificate, but only after consuming resources.

A fix to the above would be if the client already knows the server public key and the server signs a challenge in the first packet it responds. That challenge could be the ICID. This corresponds to step 4 in the third flow in the above.

If the server knows the clients public key (not usually the case, but can be used server to server), the client can can send a signed nonce.

NOTE: if the ICID is a hash of the ClientHello this prevents an attack where the attacker races a client initial. If the attacker attempts to copy the ICID with its own ClientHello, the handshake key will fail. If the attacker attempts to copy the ICID and the ClientHello, it will just be a retransmission, and the attacker will not have achieved anything. This assumes the initial packet only contains what is hashed in ICID.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2097#issuecomment-444276041