Amplification attack using the same connection id?

Jānis Čoders <janis.coders@gmail.com> Thu, 11 May 2017 11:59 UTC

MIME-Version: 1.0
From: Jānis Čoders <janis.coders@gmail.com>
Date: Thu, 11 May 2017 14:57:11 +0300
Message-ID: <CA+tEvRRGrqwGdXve8eaBSr2T9Wkb6u+gNOq=uMpwW73-T6tDtA@mail.gmail.com>
Subject: Amplification attack using the same connection id?
To: quic@ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/CWN-wyxIE64jwtwp-jxncDzd_OU>
Precedence: list

Hi, doesn't the "free to change source-ip and port" feature make
server vulnerable to amplification attacks? Imagine that there is
ongoing session and client spoofs source address, but sends the same
connection-id - and because it knows all the internal states of QUIC,
server should accept and respond to the "new spoofed" address (of
course it should be in a state where server's response is bigger than
request).
NOTE that I am talking about state after the ClientInitial has been verified.
Are my assumptions correct? If yes, then how could this be prevented?
Maybe by re-verifying that client really changed IP/port, but maybe
easier would be allowing to switch IP/port only every X seconds.

Amplification attack using the same connection id? Jānis Čoders
Re: Amplification attack using the same connectio… Benjamin Kaduk
Re: Amplification attack using the same connectio… Benjamin Kaduk
RE: Amplification attack using the same connectio… Lubashev, Igor
Re: Amplification attack using the same connectio… Benjamin Kaduk
Re: Amplification attack using the same connectio… Roland Zink
Re: Amplification attack using the same connectio… Jānis Čoders
RE: Amplification attack using the same connectio… Lubashev, Igor
RE: Amplification attack using the same connectio… Lubashev, Igor
Re: Amplification attack using the same connectio… Martin Thomson
Re: Amplification attack using the same connectio… Jānis Čoders