Re: [quicwg/base-drafts] introduce a version alias mechanism (#2573)

[martinduke <[e-mail]>]

martinduke approved this pull request.

This is a great technical solution, far better than one I hoped to achieve when I launched the issue. I strongly believe we should move forward with this and hope that enough major players will support it to make it viable.

There is a bit of an unfortunate corner case: a v1-only server might pick an alias that matches v2 or some experimental version in the internet. A client that asks for the non-alias version to that server will send an Initial that the server can't decrypt, which will result in connection failure rather than Version Negotiation. I think we should proceed even if we can't mitigate this.

> @@ -4115,6 +4130,25 @@ preferred_address (0x000d):
 ~~~
 {: #fig-preferred-address title="Preferred Address format"}
 
+version_aliases (0x000e):
+
+: A list of version numbers that the server accepts as an alias for the
+  currently used versions. This transport parameter is only sent by the server.
+  Every version alias contains a lifetime in seconds. The alias is only valid
+  for that lifetime, clients MUST NOT use it after expiry.
+
+~~~
+   struct {
+     uint32 VersionNumber;
+     varint Lifetime;

I think we should put some sort of limit on the Lifetime. A server accidentally configured to send out very long lifetimes may create long-term problems for itself. Far better for a client to reject it as invalid! I suggest something on the order of days -- certainly no more than 10^6 seconds.

> @@ -3246,7 +3246,21 @@ Implementors are encouraged to register version numbers of QUIC that they are
 using for private experimentation on the GitHub wiki at
 \<https://github.com/quicwg/base-drafts/wiki/QUIC-Versions\>.
 
-
+## Version Aliases
+
+In order to avoid ossification of the version number defined by this draft,
+servers announce a list of version numbers that they interpret as an alias for
+the version number used in this draft. Alias versions MUST NOT be a reserved
+version. Servers SHOULD send at least one version alias, and SHOULD frequently
+change the value that they announce. Each version alias contains a lifetime,
+which indicates how long the server will accept this version alias. It also
+contains an initial salt, which is used instead of the initial salt as defined

We should think hard about using a special salt vs. the v1 salt. Marten has, almost incidentally, engineered a weak form of SNI encryption: if you _really_ want to decode the initial, you can connect to the server yourself and likely get the salt. But a typical firewall won't be able to read the SNI anymore. This is a victory for the end-to-end principle, but perhaps a Pyrrhic one if firewalls just give up and drop QUIC.  I don't have a particularly strong opinion on how to proceed, but want the WG to make this decision deliberately.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2573#pullrequestreview-220902998