Subject: Re: [quicwg/base-drafts] Handshake guarantees/compromises (#645)

From: Martin Thomson <[email-masked]>
Date: Thu, 31 Aug 2017 02:05:50 +0000 (UTC)

Discussed this in Prague.  The working group concluded:

1. On-path attacks prior to handshake completion aren't worth expending serious effort on addressing right now. (This includes during resumption, where in theory you might be able to defend against some attacks.)  We will concentrate our efforts on defending against  attacks from off-path adversaries.

2. Off-path attacks would be protected against by using return routeability/proof of receipt.  The general bias is toward using AEAD with a fixed key (see #693), though there seems to be some disagreement about whether Version Negotiation is special or not.

3. Agreed on basic principles:

If a packet is potentially legitimate
… and it can be accepted, accept it
… and it is redundant, ignore it
… and it is in error, fail
… use CONNECTION_CLOSE if you can
… use TLS Alerts if one is provided
If the packet is clearly bad, drop it (though not to the exclusion of DoS protection strategies)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/645#issuecomment-326168485