Re: Unrecoverable loss pattern

[Marten Seemann <[e-mail]>]

The problem is that the server will not open the unencrypted packet
containing the retransmission of the FINISHED, since it already completed
the handshake AND received ACKs for all its handshake packets. We *could*
fix this problem by making the server accept unencrypted packets
indefinitely, but this comes with a whole range of problems of
man-on-the-side attacks.

On Mon, Feb 26, 2018 at 9:20 AM Christian Huitema <[e-mail]>
wrote:

> On 2/25/2018 4:58 PM, Marten Seemann wrote:
>
> @Nick: The server did get all handshake packets, please see 1. in my
> description. It's the server's ACK for the FINISHED message that is lost,
> not the FINISHED message itself.
> @Martin: Yes, it is, but I don't think there's anything problematic about
> the language in this paragraph. Since the server received ACKs for all the
> handshake messages it sent, it makes sense to not open unencrypted packets
> any more.
>
>
> See https://github.com/quicwg/base-drafts/issues/829 and
> https://github.com/quicwg/base-drafts/issues/1018 for  discussion of
> related issues.
>
> Picoquic manages these issues by handling "ACK of ACK". Normally, it will
> send ACK frames that acknowledge all packets received so far, potentially
> with a long list of ACK ranges. So if an ACK is lost, the next ACK will
> repeat the information that it carried. The list is only pruned when an
> "ACK of ACK" is received.
>
> In your example, if the FINISHED message is not acknowledged, the client
> will retransmit the stream zero data containing the FINISHED message in a
> new Handshake packet. The server will have to send an ACK of that packet,
> and the ACK range will also cover the previous packet. There is no problem
> for sending that ACK. You cannot acknowledge a protected packet in a clear
> text message, but nothing prevents you from acknowledging clear text
> packets in protected messages.
>
>
> -- Christian Huitema
>