Re: [quicwg/base-drafts] Get rid of DoS vulnerability in Reserved Bits (#2280)

[Martin Thomson <[e-mail]>]

This requirement exists because if you only remove header protection then throw the packet away, you create a side channel that allows an attacker some leverage on your header protection keys.  [The TLS draft](https://quicwg.org/base-drafts/draft-ietf-quic-tls.html#rfc.section.9.3) says:

>  For authentication to be free from side-channels, the entire process of header protection removal, packet number recovery, and packet protection removal MUST be applied together without timing and other side-channels.

Yes, it's perverse, but there are lots of cases where extra work is done to avoid creating side channels.  This ain't static RSA and the attack here isn't a Bleichenbacker attack, but there are good reasons.  And if you are suggesting that this sort of timing can't be observed, that's proven not to be the case before (see [NetSpectre](https://misc0110.net/web/files/netspectre.pdf)).

As for a DoS vulnerability, there are two bits, so you will be doing the work for 1 in four packets anyway.  And it's not hard to find packets with valid sequences.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2280#issuecomment-450613338