Subject: [quicwg/base-drafts] Security considerations (#1562)

From: ianswett <[email-masked]>
Date: Sat, 14 Jul 2018 10:40:16 -0700

Fixes #740
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1562

-- Commit Summary --

  * Security considerations

-- File Changes --

    M draft-ietf-quic-recovery.md (17)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1562.patch
https://github.com/quicwg/base-drafts/pull/1562.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562

---

From: ianswett <[email-masked]>
Date: Sat, 14 Jul 2018 10:51:10 -0700

@ianswett pushed 1 commit.

0fcd652  CI

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562/files/ee7c54f6426d70018daf49c43bec06c6015af784..0fcd652d782f5fac8a09c258f4289e995a8bd29f

---

From: janaiyengar <[email-masked]>
Date: Sat, 14 Jul 2018 11:24:23 -0700

janaiyengar commented on this pull request.

> @@ -1148,6 +1148,23 @@ retransmission timeout has been verified.
      congestion_window = kMinimumWindow
 ~~~
 
+# Security Considerations
+
+## Local Denial of Service
+
+QUIC requires congestion control, and recommends Reno. Not using a
+congestion control algorithm or using an overly aggressive
+algorithm may cause flows sharing the same link to experience
+excess delay, packet loss, and timeouts.

I don't think we need this one. I'll add a paragraph that says something about congestion control being required and Reno being the one that we describe in this doc, and point to 8085 for the rest.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#pullrequestreview-137245304

---

From: ianswett <[email-masked]>
Date: Sat, 14 Jul 2018 12:11:11 -0700

ianswett commented on this pull request.

SG, did you want to edit this PR to your liking and then land it?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#discussion_r202523042

---

From: Martin Thomson <[email-masked]>
Date: Sat, 14 Jul 2018 14:14:53 -0700

martinthomson commented on this pull request.

Another consideration to consider: Congestion control fundamentally involves the consumption of signals from unauthenticated entities.  On-path attackers can spoof or alter these signals.  An attacker can cause endpoints to reduce their sending rate by dropping packets, or alter send rate by changing ECN markings.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#pullrequestreview-137248758

---

From: janaiyengar <[email-masked]>
Date: Tue, 17 Jul 2018 15:26:31 -0700

@janaiyengar pushed 1 commit.

6914240  address comments

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562/files/0fcd652d782f5fac8a09c258f4289e995a8bd29f..6914240399d204a3c1991f424a88cfde4fd798de

---

From: janaiyengar <[email-masked]>
Date: Tue, 17 Jul 2018 15:26:47 -0700

I've addressed comments -- @ianswett PTAL

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#issuecomment-405748433

---

From: ianswett <[email-masked]>
Date: Tue, 17 Jul 2018 15:41:23 -0700

Thanks Jana, looks good.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#pullrequestreview-138048214

---

From: ianswett <[email-masked]>
Date: Tue, 17 Jul 2018 15:41:30 -0700

Merged #1562.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1562#event-1738875343