Subject: [quicwg/base-drafts] Move negotiated_version (#959)

From: Martin Thomson <[email-masked]>
Date: Fri, 24 Nov 2017 03:21:27 +0000 (UTC)

This makes it possible for a client to use substantially-similar versions of
QUIC without having to regenerate a ClientHello.  That's not a huge benefit,
but given that it is no more vulnerable to downgrade attack than before, it
seems like a worthwhile thing to do.

Note that this will have the effect of violating the terms of the version
downgrade contract.  I do this knowing that this is still very much in
development and that no sane person would deploy this protocol in its current
form expecting it to be secure.  Conveniently, it appears that endpoints that
support the newer version will not be exposed to downgrade, only those that
support versions prior to the change (and even then, it's only if they can
cause the server to emit a transport parameter that looks like the current
version.  That is possible, but for QUIC version 4 only (assuming we retain the
same basic format for that long).

Closes #710.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/959

-- Commit Summary --

  * Move negotiated_version

-- File Changes --

    M draft-ietf-quic-transport.md (64)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/959.patch
https://github.com/quicwg/base-drafts/pull/959.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/959

---

From: janaiyengar <[email-masked]>
Date: Wed, 29 Nov 2017 17:54:30 -0800

janaiyengar approved this pull request.

This is basically what GQUIC does. Christian should take a look, but LGTM modulo one nit.

>  supported_versions list and - if version negotiation was performed - that it
 would have selected the negotiated version.  A client MUST terminate the
-connection with a VERSION_NEGOTIATION_ERROR error code if the
-negotiated_version value is not included in the supported_versions list.  A
-client MUST terminate with a VERSION_NEGOTIATION_ERROR error code if
-version negotiation occurred but it would have selected a different version
-based on the value of the supported_versions list.
+connection with a VERSION_NEGOTIATION_ERROR error code if the current QUIC
+version is not listed in the supported_versions list.  A client MUST terminate
+with a VERSION_NEGOTIATION_ERROR error code if version negotiation occurred but
+it would have selected a different version if the versions in the
+supported_versions list appears in a Version Negotiation packet.

This is a run-on. The old sentence reads fine -- leave it as it is.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/959#pullrequestreview-80057739