Subject: [quicwg/base-drafts] Adding a description of stream commitment attacks in security section (#445)

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 10:52:07 -0700

See discussion of issue #435: Stream ID sequential order may create head of queue blocking.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/445

-- Commit Summary --

  * Adding a description of stream commitment attacks in security section

-- File Changes --

    M draft-ietf-quic-transport.md (34)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/445.patch
https://github.com/quicwg/base-drafts/pull/445.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 11:03:36 -0700

@huitema pushed 1 commit.

12dd1f5  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/445/files/c4cad2fcbcf1cd8dbd95bbb45485e4cae18748e9..12dd1f54f9f043c8700991d8d61ef24ac4ba8a02

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 11:54:42 -0700

464a222  Splitting long lines so the verification does not complains so much.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/445/files/12dd1f54f9f043c8700991d8d61ef24ac4ba8a02..464a222e9dda89d2b06d7e46be3fcea980c9bc3b

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 12:36:06 -0700

105e26e  Remove the trailing white space???

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/445/files/ddefb663dbeb16701bcf6181ae5176a5b52bf1ad..105e26eb0563364010052ad46a62418ecbf8c9c3

---

From: Martin Thomson <[email-masked]>
Date: Wed, 19 Apr 2017 17:37:48 -0700

martinthomson requested changes on this pull request.

I think that this could be made a lot shorter.  A malicious endpoint (it doesn't need to be a client in the general case), can open lots of streams, exhausting state on the server.  This can be done trivially, by opening a stream with a large number, which implicitly causes all lower-numbered streams to also be opened.  The stream concurrency limit prevents this, however reducing concurrency can negatively affect performance.

> +memory resource than a TCP protocol
+control block. However, the attack can be amplified if the adversarial
+client can open multiple streams with a single message.
+
+Normally, clients will open streams sequentially,
+as explained in {{stream-identifiers}}.
+However, when several streams are initiated at short intervals,
+transmission error may cause STREAM DATA frames opening streams to be
+received out of sequence. Some implementations will have provisions to
+open all intermediate streams in case of out-of-sequence arrival. For example,
+a server that receive STREAM DATA for streams 3 and then 9 may decide to
+open stream 5 and 7 immediately. An adversarial client
+would for example exploit that
+design by sending STREAM DATA for streams 3 and the 2,000,001, causing the
+server to open 1 million connections, and contributing to server resource
+exhaustion.

Actually, this is much easier: a receiver is obligated to open intervening streams if a higher-numbered stream ID is received.  Thus, on a new connection, opening stream 2000001 opens 1 million streams, *as required by the specification*.  The stream concurrency limit protects against this sort of attack.

> @@ -2697,6 +2697,45 @@ also be forward-secure encrypted.  Since the attacker will not have the forward
 secure key, the attacker will not be able to generate forward-secure encrypted
 packets with ACK frames.
 
+## Stream commitment attack

Title Case Headings are the Convention

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#pullrequestreview-33651936

---

From: Marten Seemann <[email-masked]>
Date: Wed, 19 Apr 2017 19:08:12 -0700

The state allocated for one stream is pretty small: it's probably one map entry somewhere, and a couple of counter variables (for read and write position) in the stream. So, unless chosen absurdly large (O(10e5) or so), the memory commitment should be negligible.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#issuecomment-295545393

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 20:05:51 -0700

693758b  Shortening the text, per Martin Thomson's review

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/445/files/105e26eb0563364010052ad46a62418ecbf8c9c3..693758bd94e549cd4895de8b511fca9a843a0d85

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 20:09:10 -0700

Following Martin's suggestion, I made the text somewhat shorter. I don't feel a compelling need to make it too short. I would like to make sure that future implementers understand the issue and do something about it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#issuecomment-295562508

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 20:11:33 -0700

a169a17  Trailing white spaces. This check is heinous.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/445/files/693758bd94e549cd4895de8b511fca9a843a0d85..a169a171d79ae43ded2b4a237b6996938b59ac13

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:53:55 -0700

Martin, do the changes meet your requirements?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#issuecomment-295590221

---

From: Martin Thomson <[email-masked]>
Date: Wed, 19 Apr 2017 23:09:24 -0700

martinthomson approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#pullrequestreview-33681027

---

From: Martin Thomson <[email-masked]>
Date: Wed, 19 Apr 2017 23:09:30 -0700

Yes, this looks great.  I want to ensure that others get a chance to have a look before I merge this, but I will probably merge this tomorrow-ish.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#issuecomment-295593460

---

From: Martin Thomson <[email-masked]>
Date: Sun, 23 Apr 2017 18:28:10 -0700

Merged #445.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/445#event-1053967903