Re: Payload length 0

[Martin Thomson <[e-mail]>]

It only works to ensure that the last packet remains the last packet.  That
doesn't seem like an actual defense against splitting.
On Sun, May 20, 2018 at 11:37 AM Christian Huitema <[e-mail]>
wrote:

> On 5/19/2018 6:16 PM, Jana Iyengar wrote:

>> The only way to prevent middlebox from hacking some part of the protocol
>> is to use encryption. Any clear text hack will only be a slight road
>> bump for the middle-box hackers.


> Agreed, though I'll note that authenticating may be enough in some cases,
encrypting may not be necessary.

>> For example, if we coalesce a CI and a 0-RTT packet, we could have the
>> zero RTT encryption depend on the presence of the previous packet.


> What I'm suggesting is that the length field, which is part of the
authenticated header, include this signal as zero, or non-zero. I think
this may be one interpretation of what you're saying: the header field,
which is part of the AEAD hash, encodes the presence of another packet.


> Yes, something like that would work. Maybe a flag in the first octet, "is
coalesced".

> Note that, in the plausible CI + 0RTT coalescing, splitting the CI won't
work. It will be too short, and thus rejected by the server.

> -- Christian Huitema