Re: [tsvwg] Review of draft-ietf-tsvwg-udp-options-32

[Christian Huitema <[e-mail]>]

On 4/9/2024 3:41 PM, Joe Touch wrote:
> 
>> On Apr 9, 2024, at 12:17 PM, Christian Huitema<[e-mail]>  wrote:
>>the maximum segment size option.
>> Anything that adds clear text to an already encrypted packet should be considered an attack.
> That would make all TCP or IP options used with TLS an attack. Please let us know when those are addressed.

But there have indeed been attacks against clear text TCP headers, from 
SYN attacks to RST to data insertion. There are also lots of 
intermediaries that like to mess with the TCP headers, for example 
rewriting flow control parameters or the maximum segment size option.
These have been addressed over time in TCP.

These attacks are largely mitigated in encrypted transports like QUIC. 
Adding clear text options to encrypted transports will bring new attack 
scenarios, which will typically only be discovered over time and which 
will necessitate ad hoc mitigations.

-- Christian Huitema