Subject: [quicwg/base-drafts] Avoid tracking bits in Alt-Svc quic= parameter (#1081)

From: Mike Bishop <[email-masked]>
Date: Mon, 29 Jan 2018 18:20:46 +0000 (UTC)

If a server sends an Alt-Svc entry that nominates a QUIC version that doesn't actually exist and the client goes with it, there's a tracking risk.  The client should never propose a valid version that it doesn't speak, so this isn't 32 bits of tracking, but if the server sends something in the grease range, the client knows it's okay that it doesn't speak it.  You still get 16 bits of persistent ID this way.

This can probably be avoided by adding a requirement that the client only use versions from the list that it speaks, and that if it decides to grease it MUST generate its own grease version.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1081

---

From: Martin Thomson <[email-masked]>
Date: Mon, 29 Jan 2018 15:24:30 -0800

Note that the greasing point is moot.  No implementation should ever consider itself to understand one of the reserved versions.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1081#issuecomment-361422276