Subject: [quicwg/base-drafts] Using caution (#2173)

From: ekr <[email-masked]>
Date: Thu, 13 Dec 2018 16:20:26 -0800

```
duplicate.  Implementations SHOULD use caution in relying on any data which is
contained in Initial packets that is not otherwise authenticated.
```

This is pretty hard to make sense of. Am I relying on the data as a server when I take the DH key and work with it? That's not authenticated.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2173

---

From: MikkelFJ <[email-masked]>
Date: Thu, 13 Dec 2018 16:32:01 -0800

I think this might originate from early times where all sorts of frames could exist in early transmission.

The text now says

> The payload of an Initial packet includes a CRYPTO frame (or frames) containing a cryptographic handshake message, ACK frames, or both. PADDING and CONNECTION_CLOSE frames are also permitted. An endpoint that receives an Initial packet containing other frames can either discard the packet as spurious or treat it as a connection error.

However, the connection error part might be inviting injection attacks?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2173#issuecomment-447171278