Subject: [quicwg/base-drafts] CID's should be compared in constant time (#2477)

From: Mike Bishop <[email-masked]>
Date: Fri, 15 Feb 2019 11:44:33 -0800

[If a CID can be seen or guessed, an attacker can make you decrypt garbage packets.  On-path attackers can see; nothing to do about that.  If the time it takes you to reject an invalid CID can be observed, an attacker can guess and check possible CIDs.]

On that account, it should be a requirement that CID's are compared constant time, otherwise they are easy to guess anyway.

_Originally posted by @mikkelfj in https://github.com/quicwg/base-drafts/issues/2441#issuecomment-464173546_

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477

---

From: Mike Bishop <[email-masked]>
Date: Fri, 15 Feb 2019 11:45:01 -0800

However, if you have to be on path to observe processing time, this is moot.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464175612

---

From: MikkelFJ <[email-masked]>
Date: Fri, 15 Feb 2019 19:53:40 +0000 (UTC)

> However, if you have to be on path to observe processing time, this is moot.

You don't, because the endpoint cannot know what the correct path is before knowing the CID, assuming there is more than one possible path, as is usually the case.

BTW: there could be attacks on middle boxes that learn what valid CID's are, but do not compare these constant time. I'm not sure how effective that would be though.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464178398

---

From: Kazuho Oku <[email-masked]>
Date: Fri, 15 Feb 2019 19:19:51 -0800

I think @mikkelfj is technically correct. A simple attack would be like the following.

Assume there's a server using an ordered list to maintain CIDs. When it receives a packet, it scans the list in ascending order until it finds a matching CID (or if reaches the end of the list without finding one).

An attacker can bisect the server to see which CIDs is active, by observing the difference in the latency of receiving stateless resets. This is much convenient than a brute-force attack that tries every possible CID to see if one is active.

If we need to be clear about the constant time requirement is a different question.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464278972

---

From: MikkelFJ <[email-masked]>
Date: Fri, 15 Feb 2019 22:25:40 -0800

I’m not sure it is worth reqiiring. Then we should also say constant time hash tables should br salted.

Note that popular Splay trees are vulnerable to manipulation.

Disabling Reset could be a recommendation if under attack.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464299965

---

From: Dmitri Tikhonov <[email-masked]>
Date: Sat, 16 Feb 2019 06:11:40 -0800

This is rather far-fetched.  This requirement does not belong in the spec.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464350187

---

From: Martin Thomson <[email-masked]>
Date: Sun, 17 Feb 2019 11:46:07 -0800

The "secret" here is a connection ID.  Something we put in packets without encryption.

If the cost is that you can force a server to attempt to decrypt packets, that's relatively easy to do by other means.  If the point is to attribute that pointless work to others, that's maybe a tiny bit interesting as a DoS vector, but it seems to me like this isn't that useful a thing to document.

The underlying assumption here has always been that decryption, successful or otherwise, is cheap enough that an attacker ends up spending more resources in sending the packet than the defender does in discarding them.  That's not completely true as decryption isn't free, but the cost/benefit to an attacker is very low and - relevant to our current effort - it is extremely difficult to defend if you assume differently. From that perspective, I don't think we should do anything about this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464500176

---

From: ianswett <[email-masked]>
Date: Mon, 18 Feb 2019 15:08:09 -0800

+1 to Martin's suggestion to not do anything about this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464916752

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 18 Feb 2019 19:09:21 -0800

I agree with @martinthomson that we've assumed decryption to be relatively cheap, and that being able to guess a CID is therefore not a particularly interesting attack.  I don't think this issue warrants any language in the spec.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-464962641

---

From: MikkelFJ <[email-masked]>
Date: Tue, 19 Feb 2019 06:59:30 +0000 (UTC)

No arguments here, but why are we so determined on protecting against packet number guessing, but not CID guessing? https://tools.ietf.org/html/draft-ietf-quic-tls-18#page-30 (QUIC-TLS section 9.3)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-465009908

---

From: Martin Thomson <[email-masked]>
Date: Tue, 26 Feb 2019 15:12:53 -0800

Packet numbers cross paths, CIDs don't.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#issuecomment-467654169

---

From: Martin Thomson <[email-masked]>
Date: Tue, 26 Feb 2019 15:12:53 -0800

Closed #2477.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2477#event-2166444283