Re: [quicwg/base-drafts] Allow most frames in 0-RTT (#2355)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> +Processing of QUIC frames is idempotent and cannot result in invalid connection
+states if frames are replayed, reordered or lost.  QUIC connections do not
+produce effects that last beyond the lifetime of the connection, except for
+those produced by the application protocol that QUIC serves.
+
+Note:
+
+: TLS session tickets and address validation tokens are used to carry QUIC
+  configuration information between connections.  These MUST NOT be used to
+  carry application state.  The potential for reuse of these tokens means that
+  they require stronger protections against replay.
+
+A server that accepts 0-RTT on a connection incurs a higher cost than accepting
+a connection without 0-RTT.  This includes higher processing and computation
+costs.  Servers need to consider the probability of replay and all associated
+costs when accepting 0-RTT.

Your point being that a client can keep their costs low?  That's not relevant here.  What matters is what the server spends relative to other connections.

Keep in mind that a client can replay a ClientHello to a server and have it do the work of connection establishment (which is considerable in terms of computation).  The delta for 0-RTT is all the processing that might be triggered by the replayed 0-RTT packets, which might mean buffering or application-level actions.  If that work is significant, and it could be, then you have an exposure.  Add the relatively negligible work of accepting packets and decrypting them if you must.

In terms of outright expense to a server, it is entirely possible that spamming bogus ClientHello messages (which don't even need valid key shares, possibly not even valid anything) could more effective than spamming 0-RTT.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2355#discussion_r263578413