Subject: Re: [quicwg/base-drafts] Timing issues in version downgrade attack prevention (#1810)

From: Martin Thomson <[email-masked]>
Date: Tue, 29 Jan 2019 19:08:19 -0800

Removing downgrade protection (#1773) will fix this, and the responsibility for fixing this will fall on the extension draft.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458794857

---

From: martinduke <[email-masked]>
Date: Tue, 29 Jan 2019 19:09:02 -0800

Given #2001, I'm not convinced this is a problem. Post-VN, we'll have the same CID and it's routed to the same server. Server upgrade between two INITIAL packets on the same CID is an exceedingly small corner case.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458794978

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 29 Jan 2019 19:38:10 -0800

@martinduke I'm not sure if I agree.

Firstly, the server might get upgraded after sending VN but before it receives the resent Initial. So there's a timing issue. Secondly, future version of QUIC might have different definition of CID than what we have in v1. In such case, CID will change when the client downgrades to v1 (in response to VN).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458800000

---

From: martinduke <[email-masked]>
Date: Tue, 29 Jan 2019 19:45:16 -0800

Isn't the CID invariant?

On Wed, Jan 30, 2019 at 12:38 PM Kazuho Oku <[email-masked]>
wrote:

> @martinduke <https://github.com/martinduke> I'm not sure if I agree.
>
> Firstly, the server might get upgraded after sending VN but before it
> receives the resent Initial. So there's a timing issue. Secondly, future
> version of QUIC might have different definition of CID than what we have in
> v1. In such case, CID will change when the client downgrades to v1 (in
> response to VN).
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458800000>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AXRMEeBiC90AXrTQnafAvycWFWQ8LI3Cks5vIROigaJpZM4W-Lrv>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458801147

---

From: martinduke <[email-masked]>
Date: Tue, 29 Jan 2019 19:45:25 -0800

Isn't the CID invariant?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458801173

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 29 Jan 2019 20:01:54 -0800

Length of CID is. How to use the CID field is not.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1810#issuecomment-458803725