Subject: [quicwg/base-drafts] Optimistic ACKs and PFS in security considerations (#2160)

From: ekr <[email-masked]>
Date: Thu, 13 Dec 2018 13:02:51 -0800

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160

---

From: ekr <[email-masked]>
Date: Thu, 13 Dec 2018 13:03:00 -0800

```
The second mitigation is that the server can require that acknowledgments for
sent packets match the encryption level of the sent packet.  This mitigation is
useful if the connection has an ephemeral forward-secure key that is generated
and used for every new connection.  If a packet sent is protected with a
forward-secure key, then any acknowledgments that are received for them MUST
also be forward-secure protected.  Since the attacker will not have the
forward-secure key, the attacker will not be able to generate forward-secure
protected packets with ACK frames.
```

I don't understand what this means. Forward-security doesn't matter
here because you always get fresh keys for each connection and if you
don't see SH, you can't send packets.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#issuecomment-447119622

---

From: MikkelFJ <[email-masked]>
Date: Thu, 13 Dec 2018 21:08:54 +0000 (UTC)

This might be a leftover from before the change towards multiple packet number spaces. An attempt to ensure ACK's use the proper "channel".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#issuecomment-447121265

---

From: Martin Thomson <[email-masked]>
Date: Thu, 13 Dec 2018 18:52:26 -0800

Definitely @janaiyengar's text.  "Forward-secure" is a turn of phrase gQUIC uses.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#issuecomment-447195750

---

From: janaiyengar <[email-masked]>
Date: Fri, 14 Dec 2018 17:10:55 -0800

Wow, this text is weird. I don't remember writing this, but then I don't remember half the things I do. I'll send a PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#issuecomment-447523338

---

From: janaiyengar <[email-masked]>
Date: Fri, 14 Dec 2018 17:26:23 -0800

PR #2188 sent.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#issuecomment-447524916

---

From: janaiyengar <[email-masked]>
Date: Sun, 16 Dec 2018 10:04:55 -0800

Closed #2160 via #2188.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2160#event-2028967170