Subject: [quicwg/base-drafts] Specify Version Negotiation and Crypto Failure (#1069)

From: Christian Huitema <[email-masked]>
Date: Wed, 24 Jan 2018 17:55:40 -0800

During the recent interop tests, we have seen a number of version negotiation failures, which goes like that:

 1) Client sends packet with a test version number, e.g., 1a1a1a1a. Content of packet is encrypted with
    some version dependent "cleartext key" -- note the same a specified in draft-08.
 2) Server receives packet, and fails to decrypt the content.
 3) Server thus ignores the packet. No version negotiation.

The TLS spec seems unambiguous:
~~~
The salt value is a 20 octet sequence shown in the figure in hexadecimal notation. Future versions of QUIC SHOULD generate a new salt value, thus ensuring that the keys are different for each version of QUIC. This prevents a middlebox that only recognizes one version of QUIC from seeing or modifying the contents of handshake packets from future versions.
~~~
Yet, several implementations missed that. Is the spec clear enough? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1069

---

From: Mike Bishop <[email-masked]>
Date: Thu, 25 Jan 2018 02:18:10 +0000 (UTC)

In theory, you can't hit a crypto failure -- if the version is unknown, you have no data about what packet protection might have been used on the payload, let alone key selection.  If the version number is unknown, you have no reference point to interpret any field outside the invariants.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1069#issuecomment-360339501

---

From: Christian Huitema <[email-masked]>
Date: Thu, 25 Jan 2018 02:33:02 +0000 (UTC)

@MikeBishop yes, you are right in theory. But in practice I just tested that two implementations out of 10 got it wrong, so I suspect we need to be a bit more explicit.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1069#issuecomment-360341841

---

From: Mike Bishop <[email-masked]>
Date: Thu, 25 Jan 2018 02:54:25 +0000 (UTC)

Section 7.2.1 seems to already discuss this.  It sounds like the problem is that people are jumping directly to decrypting and missing the discussion of determining whether the version is appropriate.  I think Section 7 is evolving in a direction of an overall "how to process incoming packets" flowchart -- maybe that's the needed clarification.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1069#issuecomment-360345250