Subject: Re: [quicwg/base-drafts] Starting packet number (#35)

From: JimRoskind <[email-masked]>
Date: Mon, 23 Jan 2017 10:39:47 -0800

Reading the motivation (re: off-path guessing of connection ID), I'm hopeful that a client would use a good Random Number Generator (RNG) and not produce a "guessable" connection ID. The presumption of a "good RNG" is indeed central to having many clients connecting to a single server (without collision).  If one would posit a poor RNG... then in addition to collisio problems, I'd be wary that a RNG used to select a "unguessable" initial packet number would be problematic.  Bottom line: I don't grok the security based motivation.

The other motivation is to prevent "ossification."  Can someone provide a plausible motivation for a "need" to start at a different packet number, and avoid "ossification" in this context?  I would have expected that standardization in this area simplifies code, and would not be a long-term problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/35#issuecomment-274577656

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 25 Jan 2017 20:30:50 -0800

Discussed in Tokyo; agreement that it's a good idea. Randomise some number of the bottom bits. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/35#issuecomment-275305655