Re: [quicwg/base-drafts] Stateless reset comparisons (constant time/any order/datagram) (#2993)

[Jana Iyengar <[e-mail]>]

janaiyengar commented on this pull request.



> -An endpoint detects a potential stateless reset when an incoming packet either
-cannot be associated with a connection, cannot be decrypted, or is marked as a
-duplicate packet.  The endpoint MUST then compare the last 16 bytes of the
-packet with all Stateless Reset Tokens that are associated with connection IDs
-that the endpoint recently used to send packets from the IP address and port on
-which the datagram is received.  This includes Stateless Reset Tokens from
-NEW_CONNECTION_ID frames and the server's transport parameters.  An endpoint
-MUST NOT check for any Stateless Reset Tokens associated with connection IDs it
-has not used or for connection IDs that have been retired.
-
-If the last 16 bytes of the packet values are identical to a Stateless Reset
+An endpoint detects a potential stateless reset using the trailing 16 bytes of
+the UDP datagram.  The endpoint compares the last 16 bytes of the datagram with
+all Stateless Reset Tokens that are associated with connection IDs that the
+endpoint recently used to send packets from the IP address and port on which the
+datagram is received.

To detect stateless resets, an endpoint remembers all Stateless Reset Tokens along with the associated connection IDs and the corresponding IP address and port that it recently used to send packets. The endpoint detects a received packet as a stateless reset by comparing the last 16 bytes of a received datagram with Stateless Reset Tokens that are associated with the IP address and port on which the datagram was received.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2993#pullrequestreview-302093897