Re: Space for Packet Metadata

[Christian Huitema <[e-mail]>]

On 3/3/2018 10:54 AM, Praveen Balasubramanian wrote:

> By mandating a minimum MTU that is greater than the IP protocol minimum, are we assuming a fallback to TCP at application layer? I think the right thing to do for QUIC to stand on its own as a transport is proper PMTUD and be handle to min IPv4 MTU gracefully? Looking forward to the data about path MTUs.

There is another reason -- avoiding DOS amplification. If the number of
bytes in the client hello is much smaller than the number of bytes in
the server first flight, adversaries can use that to amplify their DOS
attacks. Not quite as bad as memcached, but still bad.

The current spec mitigates this problem by requiring that the CI be
padded to at least 1200 bytes. That's a partial mitigation, since the
server first flight is "a few hundred bytes and a certificate", and the
certificate can easily be over 2KB. So we have an amplification factor
of 2 or 3. If the CI was only padded to 512 bytes, the amplification
factor would be 5 or 6, which is quite bad.

-- Christian Huitema