Subject: [quicwg/base-drafts] Adding a description of the Slowloris attack in security section (#448)

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 21:25:10 -0700

You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/448

-- Commit Summary --

  * Update draft-ietf-quic-transport.md

-- File Changes --

    M draft-ietf-quic-transport.md (23)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/448.patch
https://github.com/quicwg/base-drafts/pull/448.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/448

---

From: Martin Thomson <[email-masked]>
Date: Wed, 19 Apr 2017 21:36:07 -0700

martinthomson approved this pull request.

LGTM

> @@ -2735,6 +2742,22 @@ also be forward-secure encrypted.  Since the attacker will not have the forward
 secure key, the attacker will not be able to generate forward-secure encrypted
 packets with ACK frames.
 
+## Slowloris Attacks
+
+The attacks commonly known as Slowloris {{SLOWLORIS}}
+try to keep many connections
+to the target endpoint open and hold them open as long as possible. These attacks
+can be executed against a QUIC endpoint by slowly sending small amount of
+data on an open stream, slowly opening the flow control windows in order
+to limit the sender rate, or possibly manufacturing QUIC ACK that
+simulate a high loss rate and slow down sending by the other endpoint.
+
+QUIC implementers should consider implementing the
+classic mitigations of the Slowloris attack, such as increasing the maximum

"the classic" isn't needed :)  How about "QUIC deployments SHOULD provide mitigations for the Slowloris attack, such as ..."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/448#pullrequestreview-33672485

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 21:45:49 -0700

@huitema pushed 1 commit.

dec12c2  fixing the slowloris reference.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/48f580ccbc19fa900c43e37eb065c20999abb2f0..dec12c295c05a6e180f5d494c2f42b1665f0cba5

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 21:47:12 -0700

huitema commented on this pull request.

+## Slowloris Attacks
+

OK, will fix that once I get to pass the online checks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/448#discussion_r112364877

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 21:52:49 -0700

bfd754a  Strengthen the SHOULD mitigate text

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/dec12c295c05a6e180f5d494c2f42b1665f0cba5..bfd754a4883ad53a9edd2688f080fdc3ca245050

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:05:27 -0700

f725b84  More punch cards.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/bfd754a4883ad53a9edd2688f080fdc3ca245050..f725b84c8cd3d989ae28c8bd8a1d3ccfc44cf834

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:10:57 -0700

dbdcad8  I thought I was done with punch cards 40 years ago.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/f725b84c8cd3d989ae28c8bd8a1d3ccfc44cf834..dbdcad821c05f728db4ea434dd0e3d261ed2cb5b

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:18:14 -0700

0eeb693  trailing white space.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/dbdcad821c05f728db4ea434dd0e3d261ed2cb5b..0eeb693b59ac0a55c4224063f2bb9b2d5d197449

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:25:52 -0700

6aa8d9e  whatever.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/0eeb693b59ac0a55c4224063f2bb9b2d5d197449..6aa8d9ea2cbfc552f39cb3f6a43994ab08891522

---

From: huitema <[email-masked]>
Date: Wed, 19 Apr 2017 22:31:17 -0700

9dbba10  Punch me.

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/448/files/6aa8d9ea2cbfc552f39cb3f6a43994ab08891522..9dbba1032099ede1727e9bdb5907a4c686eb1a51

---

From: Martin Thomson <[email-masked]>
Date: Sun, 23 Apr 2017 18:28:10 -0700

Merged #448.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/448#event-1053967906