Subject: [quicwg/base-drafts] Reconsider the use of FNV-1a for "cleartext" integrity (#554)

From: ekr <[email-masked]>
Date: Mon, 22 May 2017 18:17:35 -0700

We had consensus to use FNV-1a to provide integrity for packets in non-adversarial settings. However as observed in #522, we still have to potentially worry about packet injection from off-path attackers. A natural design is to have the pre-handshake integrity check be somehow keyed by information in the ClientHello (e.g., the conn id). In this case, we would probably want to use something more like HMAC, though it's not necessarily required.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/554

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 May 2017 23:00:50 -0700

Is this just a more complicated way of providing proof of receipt?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/554#issuecomment-303625836

---

From: ekr <[email-masked]>
Date: Tue, 23 May 2017 23:08:28 -0700

I don't think so.... It's rather a way of avoiding injection of bogus handshake packets by off-path attackers.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/554#issuecomment-303626996