Subject: Re: [quicwg/base-drafts] Repeating Version Negotiation (#143)

From: Martin Thomson <[email-masked]>
Date: Thu, 09 Mar 2017 20:09:42 -0800

The denial of service exposure is limited to an attacker successfully racing their ServerHello with the legitimate response from the real server.  With #361, an attacker doesn't need to see the entropy in the QUIC header to construct this message, all it has to know is that the client is going to be trying to handshake on a given 5-tuple. 

The fact that the remainder of the packet will be unusable (an off-path attacker won't be able to construct a valid set of handshake traffic keys) doesn't mean that the client will be any happier.  The only defense against that is to insist that the client operate multiple parallel handshakes.  That's probably too much effort for an attack with such narrow applicability.

If the attacker is on-path, they win, of course.

Historically, we've let denial of service attacks on the handshake to succeed, it's just too easy for an attacker to mess with things at that stage.  That might be the right answer here too.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/143#issuecomment-285569294