Re: [quicwg/base-drafts] Invert the connection ID logic during the handshake (#442)

[Brian Trammell <[e-mail]>]

In general, this seems like a reasonable thing to do.

With respect to DoS, any time you're using an identifier that may need to be implemented using a stateful lookup -- and I don't think there's any amount of clever math that will fit into the number of bits we're willing to stick into the header that can completely avoid state -- you need to have dynamic prevention of DoS against that state. This is an essential property of the problem space.

This design, however, stretches the already not-very-helpful "Connection ID" terminology beyond its breaking point, so I'd suggest we rename it in the process of doing this:

(1) In the initial client packet, this field doesn't "identify" a connection; it's basically just a nonce. 

(2) Server-chosen connection IDs don't actually identify connections either; they contain client-opaque information that can be used by the server or server-adjacent forwarding devices for whatever purpose the server sees fit. This is more a token than an identifier. 

This would admittedly make the packet diagrams a little more complex -- some packets have a nonce, some packets have a token -- but the nonce/token is taking up the same bitspace in the header.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/442#issuecomment-297640203