Re: [quicwg/base-drafts] token-based greasing / initial packet protection (#3166)

[Mike Bishop <[e-mail]>]

MikeBishop commented on this pull request.

This direction is starting to sound reasonable.

> +The token MUST include or associated with the alternative version number with
+which it can be used.

At a minimum, "be associated with."  But better, I think, to say that the token MUST permit the server to recover the base version number associated with the obfuscated version, the salt, and the mask.  Exactly how the server arranges that is an implementation detail.

> +  0-RTT, and Retry packets. This XOR is applied after the packets are encrypted
+  and before they are decrypted.
+
+* Alternative initial salt; a 16-byte binary blob that is to be used in place of
+  the initial salt defined in section 5.2 of {{QUIC-TLS}}.
+
+A server advertises these values using a NEW_TOKEN frame {{frame-new-token}}.
+The token MUST include or associated with the alternative version number with
+which it can be used.
+
+Typically, a server would pre-allocate a set of unused version numbers as the
+alternative version numbers, associating each of those version numbers with a
+packet type modifier chosen at random.  Then, when issuing a token using a
+NEW_TOKEN frame, the server generates the alternative initial salt by calling a
+pseudo-random function, embeds that initial salt into the token which is then
+encrypted, and sends a NEW_TOKEN frame that comprises of the generated token and

```suggestion
encrypted, and sends a NEW_TOKEN frame that contains the generated token and
```

> @@ -3940,6 +4007,19 @@ described in {{QUIC-TLS}}.  This protection does not provide confidentiality or
 integrity against on-path attackers, but provides some level of protection
 against off-path attackers.
 
+Additionally, the token is accompanied by a checksum.  This is because when a

I second the question here; the checksum doesn't appear to serve a purpose not already covered here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3166#pullrequestreview-308759320