Subject: [quicwg/base-drafts] de69df: Increase resilience to spoofed Version Negotiation...

From: Martin Thomson <[email-masked]>
Date: Thu, 11 May 2017 23:04:23 -0700

Branch: refs/heads/validate_vn
  Home:   https://github.com/quicwg/base-drafts
  Commit: de69df98de55e64cd169a9d2f7a10498cddb5b72
      https://github.com/quicwg/base-drafts/commit/de69df98de55e64cd169a9d2f7a10498cddb5b72
  Author: Martin Thomson <[email-masked]>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Increase resilience to spoofed Version Negotiation packets

There's two layers of defense here:

1. Version Negotiation echoes 31-bits of entropy (maybe more if you consider the version to be at all unpredictable, or the client's source address to contain any entropy).

2. If validation fails and version negotiation happened, encourage the client to try again ignoring any Version Negotiation packets that match the failed profile.

Closes #523.