Subject: [quicwg/base-drafts] Require RFC8470 (#2433)

From: Mike Bishop <[email-masked]>
Date: Wed, 06 Feb 2019 16:55:51 -0800

Fixes #2432.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2433

-- Commit Summary --

  * Require RFC8470

-- File Changes --

    M draft-ietf-quic-http.md (11)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2433.patch
https://github.com/quicwg/base-drafts/pull/2433.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2433

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Feb 2019 18:13:34 -0800

martinthomson commented on this pull request.

This supercedes what I added in #2355. 

Not sure that we need the exposition, given the risk of getting things subtly wrong though.

> @@ -234,6 +234,17 @@ SETTINGS frame. After the QUIC connection is established, a SETTINGS frame
 ({{frame-settings}}) MUST be sent by each endpoint as the initial frame of their
 respective HTTP control stream (see {{control-streams}}).
 
+## Early Data and HTTP/3
+
+QUIC provides a facility for early data during the first flight of packets sent
+by the client.  Early data is not subject to the same security guarantees as
+data sent after the handshake completes.  In particular, this data can be
+replayed by an attacker able to capture the packets and the server will not know

This isn't entirely true.  Capturing and replaying packets is not sufficient, or even necessary for an attack.  I would instead point at TLS 1.3 and the discussion about what can happen there than try to repeat it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2433#pullrequestreview-200896072

---

From: Mike Bishop <[email-masked]>
Date: Thu, 07 Feb 2019 10:08:45 -0800

I missed / forgot that you'd added this requirement in #2355.  I'm happy to just run with that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2433#issuecomment-461535805

---

From: Mike Bishop <[email-masked]>
Date: Thu, 07 Feb 2019 10:08:46 -0800

Closed #2433.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2433#event-2124841181