Re: [quicwg/base-drafts] Connection ID lengths 1, 2 and 3 bytes can't be encoded (#1570)

Kazuho Oku <> Wed, 08 August 2018 04:35 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 779DD12F1AB for <>; Tue, 7 Aug 2018 21:35:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -8.01
X-Spam-Status: No, score=-8.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ie0ZaEtsUCwa for <>; Tue, 7 Aug 2018 21:35:14 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5CD831286E3 for <>; Tue, 7 Aug 2018 21:35:14 -0700 (PDT)
Date: Tue, 07 Aug 2018 21:35:12 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1533702912; bh=2W09X6fb3l89IobmijDzz1VFd7wFTHCyWN9lkN1TKOU=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=AcJ/lOfDfofkWe1M9GKhiiFPam/Z3TzXu4y4l29Vp0+Lic5yxBSRPA4b+xZI/cESP 27XQXz32OvAxj6vOa1pBTMaI+U1/ppPKPEQGb7SAO3Jo5VsmRu/OAuv9EzP32S1+Ys CdSNCdqtkKsXRJ9mnXcnFQqFjG++ENfWOsiigF1A=
From: Kazuho Oku <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/issues/1570/>
In-Reply-To: <quicwg/base-drafts/issues/>
References: <quicwg/base-drafts/issues/>
Subject: Re: [quicwg/base-drafts] Connection ID lengths 1, 2 and 3 bytes can't be encoded (#1570)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5b6a7300acc39_1b703ffb908be61c2466a3"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: kazuho
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.27
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 08 Aug 2018 04:35:17 -0000

In addition to what @martinthomson has pointed out, I would like to note that it is possible to implement a deterministic approach for shorter CIDs (e.g. 4 octets).

One way is to let the endpoint track the CIDs for which it has generated a stateless reset, and rotate the reset key when the size of the tracked CIDs exceeds certain threshold, at the same time enforcing the active clients to switch to new CIDs (so that they can be reset using a stateless reset generated by the new key). You can use a probablistic structure (e.g. bloom filter) to track the CIDs for which stateless resets has been generated.

However, my understanding is that such approach does not work well for very short CIDs (e.g. 1 octet), because when under attack, the number space will be consumed by the attacker faster than clients migrate to new CIDs.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: