Re: Payload length 0

[Jana Iyengar <[e-mail]>]

Just to be clear about what I'm suggesting:

Packets that are coalesced in a UDP datagram have their length fields set
to the packet length. Packets that are not coalesced set the packet length
to zero.
A receiver that sees a non-zero packet length field in a long header checks
if this packet is coalesced. Similarly, a packet that is received with a
zero in the packet length field must be not coalesced.

I believe this protects from splitting.

CFIN+1RTT packets can also be coalesced in addition to CI+0RTT.

On Sun, May 20, 2018 at 12:14 AM, Martin Thomson <[e-mail]>
wrote:

> It only works to ensure that the last packet remains the last packet.  That
> doesn't seem like an actual defense against splitting.
> On Sun, May 20, 2018 at 11:37 AM Christian Huitema <[e-mail]>
> wrote:
>
> > On 5/19/2018 6:16 PM, Jana Iyengar wrote:
>
> >> The only way to prevent middlebox from hacking some part of the protocol
> >> is to use encryption. Any clear text hack will only be a slight road
> >> bump for the middle-box hackers.
>
>
> > Agreed, though I'll note that authenticating may be enough in some cases,
> encrypting may not be necessary.
>
> >> For example, if we coalesce a CI and a 0-RTT packet, we could have the
> >> zero RTT encryption depend on the presence of the previous packet.
>
>
> > What I'm suggesting is that the length field, which is part of the
> authenticated header, include this signal as zero, or non-zero. I think
> this may be one interpretation of what you're saying: the header field,
> which is part of the AEAD hash, encodes the presence of another packet.
>
>
> > Yes, something like that would work. Maybe a flag in the first octet, "is
> coalesced".
>
> > Note that, in the plausible CI + 0RTT coalescing, splitting the CI won't
> work. It will be too short, and thus rejected by the server.
>
> > -- Christian Huitema
>