Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks

[Tom Herbert <[e-mail]>]

On Mon, Aug 1, 2016 at 12:56 PM, Spencer Dawkins at IETF
<[e-mail]> wrote:
> Hi, Tom,
>
> On Mon, Aug 1, 2016 at 10:56 AM, Tom Herbert <[e-mail]> wrote:
>>
>> > On 8/1/16 4:59 PM, Tom Herbert wrote:
>> >> If that [99.999%] number it is correct it is only because home routers
>> >> have
>> >> ossified the Internet in that regard
>> >
>> > I realize that people have ossification on the head, but I'm sure you
>> > recognize that the right answer here is that most people only have a
>> > single connection into their homes.  For those who have more than one,
>>
>> Well, I'm sitting here in my home looking at my Nexus 6 and I can
>> confirm that it is attached to Internet my via Comcast wifi as well as
>> Verizon's mobile network. So my smart phone is definitely a multihomed
>> and I definitely have multiple connections into my home. Right now I'm
>> using the wifi link, but if I walk into my backyard out of range then
>> I don't want the device to have to restart all my TCP connections when
>> switching to the mobile network. Neither do I want to have to create
>> 2x connections like in MP-TCP just because I might at some point walk
>> into my back yard (it's kind of gloomy right now so I don't think I'll
>> be doing this anyway).
>
>
> I'm not going to guess what wireshark would show on your home network or on
> Verizon's, but I'm having a hard idea understanding how a TCP connection
> identified by a 5-tuple that includes a local address from your wifi routed
> through Comcast stays active when you get in a car and drive away, so that
> the only active interface on your smart phone now has a local address that
> is routed through Verizon.
>
TOU will negotiate a session identifier (similar to connection
identifier) in QUIC. With this the TCP endpoints no longer use the
5-tuple to identifier the connection, they use the session identifier.
This provides unambiguous connection identification that is
independent of addresses or encapsulating UDP ports (the most
immediate problem this resolves is NAT state remapping). Strong
security is required to prevent connection hijacking and there are a
couple of other caveats. Please look as section 3 in
draft-herbert-transports-over-udp for details.

Tom