Subject: [quicwg/base-drafts] Tokens are a mess (#1704)

From: Martin Thomson <[email-masked]>
Date: Sun, 26 Aug 2018 23:02:00 -0700

We can't realistically authenticate all tokens with up to three Retry
packets and the NEW_TOKEN message.  So they aren't really safe for much.
Describe the limitations and advise a very narrow usage.

I really hope that this choice doesn't bite us later.  It doesn't feel
that good, but I don't know how to fix this without going back to just
one Retry (and even then a solution would be ugly).

Closes #1647.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1704

-- Commit Summary --

  * Tokens are a mess

-- File Changes --

    M draft-ietf-quic-transport.md (8)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1704.patch
https://github.com/quicwg/base-drafts/pull/1704.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704

---

From: Marten Seemann <[email-masked]>
Date: Mon, 27 Aug 2018 06:13:49 +0000 (UTC)

I'm still not a fan of the multiple Retry mechanism, since it doesn't serve any purpose, except that it allows implementers to build an architecture that imposes unnecessary RTT penalties on clients.

If I remember correctly, we discussed this in Montreal, and decided to at least authenticate the token in a way that makes it impossible for middleboxes to perform a Retry. Do I remember this wrong?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#issuecomment-416124977

---

From: Martin Thomson <[email-masked]>
Date: Sun, 26 Aug 2018 23:23:23 -0700

Frankly, that week is now a vague blur.  I think that there was discussion of this point in relation to the looping issue, but I don't recall a proposal to authenticate it/them.  For those who want this feature, it would be a serious architectural imposition to require authentication.

That said, if we're going to authenticate the initial connection ID, then that would present an opportunity to fix this problem as well.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#issuecomment-416126592

---

From: MikkelFJ <[email-masked]>
Date: Mon, 27 Aug 2018 00:52:14 -0700

I did raise an issue where I touched upon a checksum and @martinthomson more explicitly stated the issue of using unauthenticated tokens. This was probably before that meeting which I did not attend to. Later the issue was resolved with no action on checksum and no argument as to why that was decided. This is all from volatile memory. I think even a simple short checksum could go a long way to protect against some forms of attack.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#issuecomment-416145497

---

From: ianswett <[email-masked]>
Date: Mon, 27 Aug 2018 13:13:29 +0000 (UTC)

I'm also still not a fan of multiple retries.  I think it's a case of us over-designing something for use cases we don't fully understand and making implementations a lot more complex.  I thought it would end up being complex, and it's ended up being much worse than I anticipated.

But I realize that's a wider issue that is out of scope of this PR, so I'll take this to the list.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#issuecomment-416222113

---

From: Mike Bishop <[email-masked]>
Date: Mon, 27 Aug 2018 10:10:46 -0700

MikeBishop commented on this pull request.

> @@ -786,6 +786,14 @@ Note:
   the packet is discarded.  A server MAY encode tokens provided with NEW_TOKEN
   frames and Retry packets differently, and validate the latter more strictly.
 
+In a stateless design, a server can use encrypted and authenticated tokens to
+pass information to clients that the server can later recover and use to
+validate a client address.  Tokens are not integrated into the crypto graphic

cryptographic

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#pullrequestreview-149798797

---

From: Nick Banks <[email-masked]>
Date: Mon, 27 Aug 2018 18:12:08 +0000 (UTC)

nibanks approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#pullrequestreview-149821831

---

From: Martin Thomson <[email-masked]>
Date: Mon, 27 Aug 2018 17:11:17 -0700

@martinthomson pushed 1 commit.

c86245c  unsplit crypto graphic

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704/files/bbef7aab87ea8992e4824e8c45889561ce8b42d3..c86245ca9c3483d9228146510bea50a84fefb653

---

From: Martin Thomson <[email-masked]>
Date: Mon, 27 Aug 2018 22:14:00 -0700

Merged #1704 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1704#event-1812145579