Date: Tue, 26 Jun 2018 21:30:01 -0700
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4ab1bd4f5e3d84229d9ef057565d0f1e50b7a6dbaf392cf00000001174ad4c992a169ce1403e20c@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/1479/400539297@github.com>
In-Reply-To: <quicwg/base-drafts/issues/1479@github.com>
References: <quicwg/base-drafts/issues/1479@github.com>
Subject: Re: [quicwg/base-drafts] Client's initial source CID is
 unauthenticated (#1479)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5b3312c9d18c4_65753fef47482f80113570";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/zkbpEHGhQB4kRIuQ8C9VYwz9_MQ>


----==_mimepart_5b3312c9d18c4_65753fef47482f80113570
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

> Regarding the IP address authentication, is that statement true considering Retry packets and tokens? Isn't one point of the Retry packet to validate the client source address?

Yeah I'd say that the server "validates" the path, but it doesn't "authenticate" the path by asking the client prove that it has selected that IP address (which is impossible for a client to prove when NAT is involved).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1479#issuecomment-400539297
----==_mimepart_5b3312c9d18c4_65753fef47482f80113570
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<blockquote>
<p>Regarding the IP address authentication, is that statement true consid=
ering Retry packets and tokens? Isn't one point of the Retry packet to va=
lidate the client source address?</p>
</blockquote>
<p>Yeah I'd say that the server "validates" the path, but it doesn't "aut=
henticate" the path by asking the client prove that it has selected that =
IP address (which is impossible for a client to prove when NAT is involve=
d).</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/issues/1479#issuecomment-400539297">view it on GitHub</a>,=
 or <a href=3D"https://github.com/notifications/unsubscribe-auth/AWbkq_JX=
8DdSkQG8N-T2JnyUsWnO29z_ks5uAwpJgaJpZM4U32YW">mute the thread</a>.<img sr=
c=3D"https://github.com/notifications/beacon/AWbkq2-0yB_LX1ou6Qkkz7JWitzD=
ew4_ks5uAwpJgaJpZM4U32YW.gif" height=3D"1" width=3D"1" alt=3D"" /></p>
<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_versio=
n":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name"=
:"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"=
quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"http=
s://assets-cdn.github.com/images/email/message_cards/header.png","avatar_=
image_url":"https://assets-cdn.github.com/images/email/message_cards/avat=
ar.png","action":{"name":"Open in GitHub","url":"https://github.com/quicw=
g/base-drafts"}},"updates":{"snippets":[{"icon":"PERSON","message":"@kazu=
ho in #1479: \u003e Regarding the IP address authentication, is that stat=
ement true considering Retry packets and tokens? Isn't one point of the R=
etry packet to validate the client source address?\r\n\r\nYeah I'd say th=
at the server \"validates\" the path, but it doesn't \"authenticate\" the=
 path by asking the client prove that it has selected that IP address (wh=
ich is impossible for a client to prove when NAT is involved)."}],"action=
":{"name":"View Issue","url":"https://github.com/quicwg/base-drafts/issue=
s/1479#issuecomment-400539297"}}}</script>
<script type=3D"application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/1479#issuecomment=
-400539297",
"url": "https://github.com/quicwg/base-drafts/issues/1479#issuecomment-40=
0539297",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
},
{
"@type": "MessageCard",
"@context": "http://schema.org/extensions",
"hideOriginalBody": "false",
"originator": "AF6C5A86-E920-430C-9C59-A73278B5EFEB",
"title": "Re: [quicwg/base-drafts] Client's initial source CID is unauthe=
nticated (#1479)",
"sections": [
{
"text": "",
"activityTitle": "**Kazuho Oku**",
"activityImage": "https://assets-cdn.github.com/images/email/message_card=
s/avatar.png",
"activitySubtitle": "@kazuho",
"facts": [

]
}
],
"potentialAction": [
{
"name": "Add a comment",
"@type": "ActionCard",
"inputs": [
{
"isMultiLine": true,
"@type": "TextInput",
"id": "IssueComment",
"isRequired": false
}
],
"actions": [
{
"name": "Comment",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"IssueComment\",\n\"repositoryFullName\": \=
"quicwg/base-drafts\",\n\"issueId\": 1479,\n\"IssueComment\": \"{{IssueCo=
mment.value}}\"\n}"
}
]
},
{
"name": "Close issue",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"IssueClose\",\n\"repositoryFullName\": \"q=
uicwg/base-drafts\",\n\"issueId\": 1479\n}"
},
{
"targets": [
{
"os": "default",
"uri": "https://github.com/quicwg/base-drafts/issues/1479#issuecomment-40=
0539297"
}
],
"@type": "OpenUri",
"name": "View on GitHub"
},
{
"name": "Unsubscribe",
"@type": "HttpPOST",
"target": "https://api.github.com",
"body": "{\n\"commandName\": \"MuteNotification\",\n\"threadId\": 3501849=
82\n}"
}
],
"themeColor": "26292E"
}
]</script>=

----==_mimepart_5b3312c9d18c4_65753fef47482f80113570--