Subject: [quicwg/base-drafts] No spoofed ACK attack (#2188)

From: janaiyengar <[email-masked]>
Date: Fri, 14 Dec 2018 17:25:58 -0800

... but there is an amplification one.

Closes #2160.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2188

-- Commit Summary --

  * No spoofed ACK attack

-- File Changes --

    M draft-ietf-quic-transport.md (33)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2188.patch
https://github.com/quicwg/base-drafts/pull/2188.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2188

---

From: Marten Seemann <[email-masked]>
Date: Fri, 14 Dec 2018 22:26:37 -0800

marten-seemann approved this pull request.

> -sent, the connection can be aborted.
-
-The second mitigation is that the server can require that acknowledgments for
-sent packets match the encryption level of the sent packet.  This mitigation is
-useful if the connection has an ephemeral forward-secure key that is generated
-and used for every new connection.  If a packet sent is protected with a
-forward-secure key, then any acknowledgments that are received for them MUST
-also be forward-secure protected.  Since the attacker will not have the
-forward-secure key, the attacker will not be able to generate forward-secure
-protected packets with ACK frames.
-
+({{address-validation}}) from a server and then release the IP address it used
+to acquire that token.  At a later time, the attacker may initiate a 0-RTT
+connection with a server by spoofing this same address, which might now address
+a different (victim) endpoint.  The attacker can thus potentially cause the
+server to send an initial window's worth of data towards the victim.

s/initial window's/initial congestion window/

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2188#pullrequestreview-185344900

---

From: Martin Thomson <[email-masked]>
Date: Sun, 16 Dec 2018 02:11:53 -0800

martinthomson approved this pull request.

This is two changes.  But I like both of them.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2188#pullrequestreview-185381495

---

From: janaiyengar <[email-masked]>
Date: Sun, 16 Dec 2018 10:03:07 -0800

@janaiyengar pushed 1 commit.

08c2ca21cdb03753a270b16e4c6eddd57ffb2534  congestion window

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2188/files/4920ee70d16921b2bf3140ba44949ddf1c715b9c..08c2ca21cdb03753a270b16e4c6eddd57ffb2534

---

From: janaiyengar <[email-masked]>
Date: Sun, 16 Dec 2018 10:04:55 -0800

Merged #2188 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2188#event-2028967169