Re: [quicwg/base-drafts] Client's initial destination CID is unauthenticated (#1486)

[ekr <[e-mail]>]

On Mon, Jul 9, 2018 at 1:30 PM, MikkelFJ <[e-mail]> wrote:

> @ekr <https://github.com/ekr> - yes I was just about to post the below as
> you wrote. I was confused by thinking that you only need 1 roundtrip to
> have a secret - the DH secret - but that is the inner layer of TLS.
>
> Still hard to follow - but as I read it, the initial keys are used for a
> few roundtrips. Full encryption with DH exhanged keys would be possible at
> servers response, but that is not what happens. The outer layer stays
> weakly encrypted, but the TLS messages are protected until a solid 1-RTT
> key is forged, which is more production safe than the early DH exchange
>
Huh? No. The server starts sending using the Handshake keys in its first
flight. This is clearly shown in the diagram I linked to.


Therefore the client is forced to verify that ODCID was received if it
> wants to complete the handshake.
>
The AEAD tag cannot be used to strengthen that verification further because
> the AEAD tag depends on the initial secret and cannot depend on itself.
>
> It would still be safer if the clients AEAD tag were to be stored in the
> servers TP as an extra precaution because on path attacker could otherwise
> spoof the initial packet contents knowing the ODCID from plain text. QUIC
> doesn't generally try to protect from on-path attacks, but that is in
> regards to service disruption, not loss of integrity. This is worse.
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/issues/1486#issuecomment-403609915>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABD1ofsvpnfnyzxDOhgWZJ-cMTAId61Rks5uE71LgaJpZM4U5BQ4>
> .
>


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1486#issuecomment-403611953