Subject: [quicwg/base-drafts] Non-zero streams in cleartext (#660)

From: MikkelFJ <[email-masked]>
Date: Fri, 23 Jun 2017 06:45:00 -0700

Stateless Retry, Client Cleartext, and ServerClearText permit streams other than 0. Only ClientInitial forbids streams other than stream 0.

This adds an API complexity because it must be ensured that an application does not accidentally consume data from an unprotected stream. It also works against certain optimizations for handling handshake on a separate code path. And it makes it harder to defend against abuse such as packet interception and rewrite with more streams with no formal crypto protection to attack vulnerable implemenations.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/660

---

From: MikkelFJ <[email-masked]>
Date: Tue, 27 Jun 2017 06:42:11 -0700

Also, what is the point of ACK frames in a stateless retry considering that it has no state to collect ACK data in, and considering that it is in itself effectively an ACK for client initial - of course an ack_delay timestamp could be carried to measure rtt, but is it worth the complexity for that? Might it not better to have it similar to Client Initial with stream offset 0 at stream 0?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/660#issuecomment-311361804