Re: [quicwg/base-drafts] Handling of duplicate packets (#1405)

[Magnus Westerlund <[e-mail]>]

An important clarification about this attack: The attack on AES-GCM is definitely valid for truncated authentication tags. However, my co-author clarified to me that this is not an issue for untruncated tags. So as long as QUIC uses 128 bit authentication tags for AES-GCM we should have no issue from a cryptographic perspective.

I still think not having any requirement on replay protection at the main protocol level puts a lot of responsibility on the designers of extensions as well as implementers to ensure that things truly are idempotent when sent input. 

@kazuho 

> My understanding is that the following statement in the transport draft section 5 covers this: "All QUIC frames are idempotent. That is, a valid frame does not cause undesirable side effects or errors when received more than once."

This text is only in master and was not in -12, so I didn't see it at the time I wrote the ECN PR. I think the extensibility text probably needs an RFC 2119 requirement on that any new frame types needs to fulfill that requirement. But, to fulfill that for ECN, at least if there are no strict requirement on duplication suppression do requires the ECN specification to change. Either to do receiver side suppression of the ECN field value so that it doesn't matter, or change the encoding so that one handles the duplicated packets correctly. 



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1405#issuecomment-398053419