Subject: Re: [quicwg/base-drafts] Version downgrade vulnerability (#121)

From: janaiyengar <[email-masked]>
Date: Tue, 16 May 2017 14:08:59 -0700

What in the transport params is used to validate a version negotiation? At the moment, we use only the packet number in the VN packet to verify that the packet was sent by the server.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/121#issuecomment-301916211

---

From: ekr <[email-masked]>
Date: Tue, 16 May 2017 14:38:30 -0700

The check is in the completed handshake. See:
https://quicwg.github.io/base-drafts/draft-ietf-quic-transport.html#rfc.section.7.3.4

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/121#issuecomment-301923494