Re: [quicwg/base-drafts] Long Header Packets and Routing Connection IDs (#2834)

[Kazuho Oku <[e-mail]>]

@nibanks 
>> I do not think that this is a viable design.
>> 
>> An attacker controls both the client tuple and the initial CID. A stateless load balancer has to have the capability to change the CID, otherwise, it cannot balance the load between the servers running behind.
> 
> @kazuho I don't understand how your statement shows that changing the CID only with Short Header packets is not a viable design. First, the LB isn't the one to change the CID, the backend server is the one. Second, the CID would be changing, but until a little later in the exchange.

The problem is this "a little later in the exchange" that is introduced by the proposal.

In QUIC v1, if we ignore use of 0-RTT packets (that we do not need to care under attack), the only type of packet that has client-chosen CID is the first flight sent from the client. All the packets that the client sends in response to server's packet contains a server-chosen CID.

This is an excellent property.

When receiving an Initial packet carrying a CID that does not authenticate, a load balancer can assign the connection to a server that is the least loaded (or a server can choose a thread that is the least loaded). The assigned server (or the thread) would generate an authenticated CID that maps to itself, and responds with an Initial packet that contains that CID. Then, all the subsequent packets from the client that need to be processed would carry that authenticated CID, allowing these packets to be routed using only the CID.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2834#issuecomment-505195683