Subject: Re: [quicwg/base-drafts] Connection migration should be indistinguishable from a new connection (#203)

From: Martin Thomson <[email-masked]>
Date: Mon, 15 Jan 2018 23:33:00 +0000 (UTC)

Leaving aside the migration that happens without the knowledge of the migrating endpoint (like NAT rebinding), this is tricky, if not impossible.  And it's not a property of versions, but of our invariants.

The most obvious problem here is that a handshake uses the long header, which we don't use at any time afterwards.  So we have the migrating endpoint understand the need to make its packets indistinguishable and use the long header when it knows that it has migrated.

Firstly, as Lucas says, it would be trivial for a middlebox to apply the static packet protection keys for that version of QUIC to determine that the packet isn't protected with those keys.  We know from experience with TLS that middleboxes do exactly that sort of thing.

So what do we gain by doing this?  It seems like we just create a bunch of hoops for these middleboxes to jump through, none of which are especially challenging.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/203#issuecomment-357812374

---

From: ianswett <[email-masked]>
Date: Tue, 16 Jan 2018 06:39:17 -0800

I'm happy to close this if others are, but there was a lot of interest in it previously.

I agree that making this work is tricky, but I'm a bit concerned if this becomes impossible due to our invariants.  My largest practical concern is that we'll end up in a situation where some middleboxes starting doing DPI and end up intentionally or unintentionally breaking connection migration and/or multipath.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/203#issuecomment-357979998

---

From: MikkelFJ <[email-masked]>
Date: Tue, 16 Jan 2018 15:42:11 +0000 (UTC)

Would a specialized 0-RTT handshake be suitable for migration?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/203#issuecomment-358003544

---

From: mirjak <[email-masked]>
Date: Thu, 18 Jan 2018 09:39:51 +0000 (UTC)

So I think for a some middleboxes it would actually be beneficial if a migration would look like a new flow/handshake because, as the path may have changed, you might end up at a new middlebox that does not have state yet, and it would be easier to set up new state if you can identify a QUIC flow by its handshake pattern.

However, I agree that this might be hard as you not only would need to send long headers but actually run a whole TLS handshake. Or could it even be beneficial in some cases to re-do the TLS handshake if you are on a new path?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/203#issuecomment-358591264