Re: [quicwg/base-drafts] Compatible version upgrade (#1901)

[Martin Thomson <[e-mail]>]

OK, change implemented.

I realized that we're now relying on different pieces for different capabilities.  We use unsupported versions to protect against a spoofed Version Negotiation packet.  That might lead a client to believe that the server doesn't support a version that it does.

We use the supported versions list and the compatible version upgrade to protect against an attacker rewriting the version of the Initial packet.  That suggests that the server needs to choose, it can't just stay with a version that it doesn't prefer (of course, not choosing is a form of choosing, a server could easily not care).

Then I realized that there is a weakening of our guarantees if we don't record the final version in the transcript, so I put that back.  This is mainly from a surplus of caution.  An attacker could maybe rewrite the version in the server Initial packet and convince the client that the version the server chose was different.  Of course, the version is under integrity protection for later packet types, so this would fail at that point, but it's not great that we don't have the final selection covered by the handshake, so I added it back.  It's not that hard and it makes the integrity protection far more direct.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1901#issuecomment-433266476