Subject: Re: [quicwg/base-drafts] Be more conservative about migration? (#2143)

From: Martin Thomson <[email-masked]>
Date: Tue, 29 Jan 2019 19:42:05 -0800

Discussed in Tokyo: the working group believes right now that our existing defense is OK-ish.  Roberto noted that we're not current as good as multipath TCP and suggested that we might want stronger confirmation.

@ekr will take a first stab at documenting our principles with respect to what attacks we are prepared to spend effort to defend against.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-458800632

---

From: martinduke <[email-masked]>
Date: Tue, 29 Jan 2019 19:44:33 -0800

Section 9 has a SHOULD regarding PATH_CHALLENGE; change it to a MUST?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-458801049

---

From: Martin Thomson <[email-masked]>
Date: Tue, 29 Jan 2019 21:16:14 -0800

Proposal from Tokyo:

Endpoints MUST validate new paths before using them.  In reaction to a migration they MUST continue using the old path until they receive new non-probing packets on the new path AND validation of that path is complete.  

Research question: Allow an exception in the case that the rebinding appears to be a NAT rebinding.  Heuristics are necessary here: e.g., a port-only change after a period of inactivity.  If we adopt the strict requirement, but learn that we get a lot of hitches from apparent migration, then we can find a way to relax the requirement.  If we allow this exception, then we have to address the problem of what to do when there are multiple such changes in a short period.  ==> Open this as an issue to track the research question.

Otherwise, eliminate the distinction between IP and port changes and just say "address change".

Stricter rules would close off the ability for an attacker to force a connection into a non-functioning state, even if that state is temporary.  The cost is that migration can result in a delay of a round trip or more.

(We might also want to know more about the severity of the attack.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-458815073

---

From: ianswett <[email-masked]>
Date: Tue, 29 Jan 2019 21:31:04 -0800

I'd add "appears to be intentional immediate migration" to the list of research questions.  If a PATH_CHALLENGE is bundled with other frames and the path changes, then it seems very likely the peer knows the path has changed and it's intentional.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-458817412