Re: [quicwg/base-drafts] Method for associating stateless resets with connections is unclear (#2591)

[Martin Thomson <[e-mail]>]

Looking again at this, the description is somewhat narrower than this issue implies.  The text says:

> The endpoint identifies a received datagram as a stateless reset by comparing the last 16 bytes of the datagram with all Stateless Reset Tokens associated with the remote address on which the datagram was received.

([Preceding text](https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#name-detecting-a-stateless-reset) provides a more complete description of this process.)

I understand that some implementations just have a single table, and that's OK with some caveats. The text here points away from that by suggesting the use of a table of *remote addresses*, not tokens.  At that point, the number of tokens to search through might use a second table, but they might not need to in many cases.  A linear search over a short set of tokens - using constant-time comparisons - is more likely to be correct.  

Lookup tables have less-than-ideal side-channel properties that might make it tricky to implement correctly.  (Kazuho had some nice ideas about the use of a PRF in the process to mask the lookup, but I don't expect that many people will find that approach obvious).  At this stage, I'm inclined to say that the text we have is closer to "right" and that suggesting the use of a table is likely to fail.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2591#issuecomment-571425664