Subject: [quicwg/base-drafts] Clarify amplification limit (#1863)

From: MikkelFJ <[email-masked]>
Date: Wed, 17 Oct 2018 00:22:30 -0700

On the transport text: "Servers MUST NOT send more than three times as many bytes as the number of bytes received prior to verifying the client's address. "

The text does not state what is meant by bytes received. Presumably this refers to the accumulated QUIC packet sizes excluding IP/UDP framing. Vneg and Retry is a bit vague, do you count those earlier attempts, if you can? Can you use information gained from earlier connections and if so, for how long.

Note: generally the term "octet" is being used, but there are other places where "byte" is used.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1863

---

From: Martin Thomson <[email-masked]>
Date: Wed, 17 Oct 2018 00:40:25 -0700

Also, the grammar here is bad.  I'm not going to write a PR while we're reorganizing, but I think this might help.

> Prior to verifying an address, servers MUST NOT send more than 3 octets toward that address for each octet it receives from that address.  In determining this limit, servers only count the size of successfully processed packets.

We have text elsewhere that defines what counting the size of a QUIC packet means: it's the protected packet, including the header and AEAD expansion.

I don't think that we need to mention Retry or Version Negotiation because those are intended to be stateless - if the server counts them, great, but I don't expect them to.  The effect of not counting is safe: the server will send fewer bytes.  Note that the whole point of Retry is to perform this validation, so if the server is still counting afterwards, something is wrong.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1863#issuecomment-430523609

---

From: Martin Thomson <[email-masked]>
Date: Sun, 28 Oct 2018 16:50:51 -0700

Closed #1863 via 98910f6999e5b1fc579df4002b629386223fff45.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1863#event-1931041858