Re: [quicwg/base-drafts] Limit RCID state (#3547)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> @@ -1069,6 +1069,15 @@ to cease using the connection IDs when requested can result in connection
 failures, as the issuing endpoint might be unable to continue using the
 connection IDs with the active connection.
 
+An endpoint SHOULD limit the number of outstanding RETIRE_CONNECTION_ID frames
+to bound the necessary state. In order to allow a peer to retire all previously
+issued connection IDs, the limit on the number of outstanding
+RETIRE_CONNECTION_IDs SHOULD be at least the active_connection_id_limit. An

@martinduke Thank you for the clarification. I now understand the intent. I think that we should adjust the text in this PR.

To mitigate the attacks being discussed, what we need to do is cap the amount of state used for retaining the CIDs that "are intended to be retired." While an endpoint may restrict the number of RCID frames being sent at one time, that is unrelated to the attack, and therefore I would advocate for removing that requirement (as it is an unnecessary design change).

Speaking of your implementation, what matters is 100. 4 (2 * active_connection_id_limit) is an arbitrary choice unrelated to the attack; my argument is that therefore we do not need to specify that in spec.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3547#discussion_r401355627