[quicwg/base-drafts] d92b97: Authenticate connection IDs

Martin Thomson <noreply@github.com> Wed, 11 March 2020 01:43 UTC

Return-Path: <noreply@github.com>
X-Original-To: quic-issues@ietfa.amsl.com
Delivered-To: quic-issues@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 560BD3A0DF3 for <quic-issues@ietfa.amsl.com>; Tue, 10 Mar 2020 18:43:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wW36AsKPPY0f for <quic-issues@ietfa.amsl.com>; Tue, 10 Mar 2020 18:43:07 -0700 (PDT)
Received: from out-21.smtp.github.com (out-21.smtp.github.com [192.30.252.204]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAC113A0DF0 for <quic-issues@ietf.org>; Tue, 10 Mar 2020 18:43:07 -0700 (PDT)
Received: from github-lowworker-3a0df0f.ac4-iad.github.net (github-lowworker-3a0df0f.ac4-iad.github.net [10.52.25.92]) by smtp.github.com (Postfix) with ESMTP id 00A30A098D for <quic-issues@ietf.org>; Tue, 10 Mar 2020 18:43:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1583890987; bh=uUY9Gv9V5ombejIfOe8PPaUp+0Vq1OGNvxvVNfYKvcU=; h=Date:From:To:Subject:From; b=Ash8SUfEWKBYVlC3aGt1JC0PGv6jW79wWYXijBDKDO5oVp9x8XTFtTsp28G3NlYTP TYXBn5NiFkTMxKSjkTPr8V7zcaVuZvuE8ANUzZ1lhDdyzYygAdEHmf1qL/E1hDpZfx itBwypI1dKq5VLTQq6mm0iA9RX/7lpWXwW2F8Pgc=
Date: Tue, 10 Mar 2020 18:43:06 -0700
From: Martin Thomson <noreply@github.com>
To: quic-issues@ietf.org
Message-ID: <quicwg/base-drafts/push/refs/heads/authenticate-hs-cid/f994a5-d92b97@github.com>
Subject: [quicwg/base-drafts] d92b97: Authenticate connection IDs
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-GitHub-Recipient-Address: quic-issues@ietf.org
X-Auto-Response-Suppress: All
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/kOMs87J-e6bAGXekFABVeRHwRXU>
X-BeenThere: quic-issues@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Notification list for GitHub issues related to the QUIC WG <quic-issues.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic-issues/>
List-Post: <mailto:quic-issues@ietf.org>
List-Help: <mailto:quic-issues-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic-issues>, <mailto:quic-issues-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Mar 2020 01:43:09 -0000

  Branch: refs/heads/authenticate-hs-cid
  Home:   https://github.com/quicwg/base-drafts
  Commit: d92b9781fecedbe32471d0051805e29b62989a77
      https://github.com/quicwg/base-drafts/commit/d92b9781fecedbe32471d0051805e29b62989a77
  Author: Martin Thomson <mt@lowentropy.net>
  Date:   2020-03-11 (Wed, 11 Mar 2020)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Authenticate connection IDs

This authenticates all of them.

Note that I have chosen to use position in the protocol (Source vs.
Destination) as opposed to who selects the values (client vs. server) as
the means of deciding where each lies.  This avoids regressing an
existing protocol characteristic.

This changes the definition of original_connection_id so that it is
mandatory for the server to include always.  A new
handshake_connection_id (which might be initial_connection_id, but I
think that's confusing) is also mandatory for both roles.  The
retry_connection_id is used when there is a Retry.

This is a granular encoding.  That means some additional bytes for the
types of transport parameters, but not so many as to be intolerable, I
think.  A single transport parameter, or a header on the transport
parameter encoding (as we used to have) might be slightly more
efficient, but offhand I think that the net saving would be at most 2
bytes, so I'm going with simple over small.

Closes #3439.