Re: [quicwg/base-drafts] Allow most frames in 0-RTT (#2355)

[Jana Iyengar <[e-mail]>]

janaiyengar commented on this pull request.



> +this could increase these costs because attackers can send copies of 0-RTT
+packets to different server instances, causing the processing to be repeated.
+Servers MUST ensure that they account for any increase in costs before accepting
+connections or 0-RTT.
+
+Ultimately, the responsibility for managing the risks of replay attacks with
+0-RTT lies with an application protocol.  An application protocol that uses QUIC
+MUST describe how the protocol uses 0-RTT and the measures that are employed to
+protect against replay attack.  Disabling 0-RTT entirely is the most effective
+strategy.
+
+In the core protocol, particular attention needs to be paid to STREAM frames,
+which carry application data.  If another frame type carries, or could carry,
+application semantics, then the risk from replay attack needs to be considered.
+For instance, though this is likely to be inadvisable, an application that
+attached semantics to increases in flow control credit or stream cancellation

```suggestion
attaches semantics to increases in flow control credit or stream cancellation
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2355#pullrequestreview-202971055