Re: [quicwg/base-drafts] clarify the scope of a NEW_TOKEN token (#3156)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> @@ -1698,10 +1698,14 @@ encrypted form in the token.
 It is unlikely that the client port number is the same on two different
 connections; validating the port is therefore unlikely to be successful.
 
-If the client has a token received in a NEW_TOKEN frame on a previous connection
-to what it believes to be the same server, it SHOULD include that value in the
-Token field of its Initial packet.  Including a token might allow the server to
-validate the client address without an additional round trip.
+A token received in a NEW_TOKEN frame is applicable against the servers that the
+connection is considered authoritative for (e.g., server names included in the
+certificate).  A client MUST only use a token that is applicable to the server

I don't remember making that argument, but I guess I could have said that.

The particular "attack" requires having a server privileged or capable enough to recognize a token from a different server with a fair degree of confidence.  For NEW_TOKEN, I can maybe see how that would happen though.  I'm OK with a MUST.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3156#discussion_r339466782