RE: Spin bit decision

[Mike Bishop <[e-mail]>]

I’d consider that to be “potential for causing harm.”  We’ve decided that correlation is a potential security risk, and failure to do that exposes you to the risk.

From: Ted Hardie <[e-mail]>
Sent: Tuesday, October 2, 2018 10:06 AM
To: Mike Bishop <[e-mail]>
Cc: [e-mail]; Lars Eggert <[e-mail]>; IETF QUIC WG <[e-mail]>
Subject: Re: Spin bit decision

On Tue, Oct 2, 2018 at 9:51 AM Mike Bishop <[e-mail]<mailto:[e-mail]>> wrote:

I don’t think it’s a grim view, I think it’s a pragmatic view.  Our role is to specify the things which are fundamental to the protocol and have to happen for peers to interoperate.  Mis-using normative language for other things is an abuse of the process -- that's kind of the point of RFC 6919.



RFC 2119 says:
In particular, [normative language] MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmisssions)  For example, they must not be used to try to impose a particular method on implementors where the method is not required for interoperability.



Given that the spin bit is not “actually required for interoperation,” but is the very definition of “try to impose a particular method on implementors,” I’d say that RFC 2119 imperatives are unwarranted.

That's not quite what we generally mean by "interoperation" here.  It's quite common to have something say, in effect, "If you use X, you MUST do Y.".  So, we could have a MUST in Section 2.3 of the draft, instead of the current language:


   Each client and server MUST reset its spin value to zero when sending the

   first packet of a given connection with a new connection ID.  This

   reduces the risk that transient spin bit state can be used to link

   flows across connection migration or ID change.
That MUST doesn't say anything about when you use the spin bit, it simply says that *if*  you use it, other implementations will expect this behavior; if they get a new connection ID with a non-zero spin value, it will be a protocol error.  That pattern of use is very common.

Ted