Subject: [quicwg/base-drafts] bbef7a: Tokens are a mess

From: Martin Thomson <[email-masked]>
Date: Sun, 26 Aug 2018 23:01:48 -0700

Branch: refs/heads/token-porpoise
  Home:   https://github.com/quicwg/base-drafts
  Commit: bbef7aab87ea8992e4824e8c45889561ce8b42d3
      https://github.com/quicwg/base-drafts/commit/bbef7aab87ea8992e4824e8c45889561ce8b42d3
  Author: Martin Thomson <[email-masked]>
  Date:   2018-08-27 (Mon, 27 Aug 2018)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Tokens are a mess

We can't realistically authenticate all tokens with up to three Retry
packets and the NEW_TOKEN message.  So they aren't really safe for much.
Describe the limitations and advise a very narrow usage.

I really hope that this choice doesn't bite us later.  It doesn't feel
that good, but I don't know how to fix this without going back to just
one Retry (and even then a solution would be ugly).

Closes #1647.

      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.