Re: Malicious Version Negotiation Handling (Was: Questions about Version Negotiation Concerning Possible Handshake Interruption)

[Spencer Dawkins at IETF <[e-mail]>]

Replying with no hats ...

On Mon, Feb 19, 2018 at 8:26 AM, Lubashev, Igor <[e-mail]> wrote:

> For clients that have a tcp fallback, this kind of an attack mitigation
> would need to be done together with some happy eyeballs race. Otherwise,
> waiting for a timeout on VN has a real performance cost to the user in case
> there is no attack happening.
>

I don't understand this. Is your thinking that the attacker would send a
forged VN packet AND drop the server's response?

If so, that does make sense, but if that's not part of the scenario, I
don't know why the client wouldn't drop the forged "no acceptable version
numbers" packet and accept the server's packet, at roughly the same point
in time where there would have accepted the server's packet if there was no
attack.

Are we talking about the same thing?

(To be clear, I don't have an opinion about what the working group decides,
but I do want to understand what's being discussed)

Thanks,

Spencer


> So if this kind of an artificial delay in VN is mentioned, starting the
> fallback would need to be mentioned as well. All this seems like it could
> belong to an optimization/applicability/happy-eyeballs-for-QUIC draft, if
> it belongs anywhere at all, but not the transport draft.
>
>
> -----Original Message-----
> *From:* Eric Rescorla [[e-mail]]
> *Received:* Sunday, 18 Feb 2018, 11:55PM
> *To:* Christian Huitema [[e-mail]]
> *CC:* IETF QUIC WG [[e-mail]]
> *Subject:* Re: Malicious Version Negotiation Handling (Was: Questions
> about Version Negotiation Concerning Possible Handshake Interruption)
>
>
>
> On Sun, Feb 18, 2018 at 8:49 PM, Christian Huitema <[e-mail]>
> wrote:
>
>> On 2/18/2018 8:41 PM, Eric Rescorla wrote:
>>
>> > I don't think increasing the on-path attacker's marginal difficulty
>> > from not requiring any crypto to requiring simple crypto in order to
>> > mount a DoS attack is worth changing the protocol for.
>>
>> Changing the protocol, probably not. But Lingmo's suggestion is one of
>> the several steps that we could take against hardening against a man on
>> the side attack. And it is a very simple one: if you receive a VN that
>> does not contain any acceptable option, just ignore it. If this was
>> legit, the connection will actually break after a short timer. If it was
>> not, the next received message will be a Server Hello, and the
>> connection will progress. Sounds like a reasonable trade-off.
>>
>
> I think it's fine if people do this. I don't think it's worth requiring in
> the spec given the existence of other trivial man-on-the-side attacks.
>
> -Ekr
>
>
>> -- Christian Huitema
>>
>>
>>
>