Subject: [quicwg/base-drafts] f125a5: Write down spoofed packet guarantees

From: Martin Thomson <[email-masked]>
Date: Wed, 09 May 2018 22:53:11 -0700

Branch: refs/heads/bad-packets
  Home:   https://github.com/quicwg/base-drafts
  Commit: f125a502689429e69d4a52f4ed9c9c18b185b06f
      https://github.com/quicwg/base-drafts/commit/f125a502689429e69d4a52f4ed9c9c18b185b06f
  Author: Martin Thomson <[email-masked]>
  Date:   2018-05-10 (Thu, 10 May 2018)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Write down spoofed packet guarantees

We agreed to this a while back, but never got around to putting the conclusions in the document.  We've done some of the work by writing down the rules for use of CONNECTION_CLOSE and TLS alerts, and the related changes, but the basic principles never got articulated.

This attempts to outline what we do to authenticate packets that we receive.

* Once the handshake is done, it's mostly simple: if the AEAD fails, drop it.
* We have a small carve-out for some types of ICMP, with some strong limitations on what that information can be used for.  @igorlord might expand the PMTU usage to cover DestUnreach, but these uses permit a very narrow range of actions.
* We also have stateless reset, which is another snowflake.
* The bulk of the text here concerns the handshake.  I've covered the two mechanisms we tie into the use of connection IDs:
** Echoing the value (the only protection we have for Version Negotiation, for instance).
** The AEAD that uses the connection ID as input.

And then it explains that our only defense against an on-path attacker is to fail to establish a connection.  I think that covers all the necessary points.

Closes #645.

      **NOTE:** This service been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.