Subject: [quicwg/base-drafts] Are transport parameters mandatory? (#2528)

From: Martin Thomson <[email-masked]>
Date: Mon, 18 Mar 2019 17:04:57 -0700

All of them have defaults.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 18 Mar 2019 17:30:27 -0700

If you mean "Is sending TP mandatory", I don't think so. An endpoint that doesn't receive a TP assumes the default value. An endpoint that uses a default value does not need to advertise it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474152356

---

From: Martin Thomson <[email-masked]>
Date: Mon, 18 Mar 2019 17:33:16 -0700

The issue could have been more precisely worded.  The question was about the entire QUIC transport parameters extension.  Individual parameters are still clearly optional.

We should be very crisp about that.  Up until -18, this was mandatory, but we don't need the version parameters any more.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474152870

---

From: David Schinazi <[email-masked]>
Date: Tue, 19 Mar 2019 17:28:58 +0000 (UTC)

One nice property of making the TLS transport parameters extensions mandatory is that it helps mitigate cross-protocol attacks: QUIC servers can abort the connection if it's missing and TLS over TCP servers can abort if the extension is present.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474481950

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 19 Mar 2019 15:00:27 -0700

I think we can call the entire extension as an option.

As to @DavidSchinazi's point, I'm not sure if it helps in practice. TLS 1.3 stacks that run on top of TCP does not have (and it's doubtful if all of them would have) the capability to detect and raise an error when it sees the QUIC TP extension.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474601484

---

From: Martin Thomson <[email-masked]>
Date: Tue, 19 Mar 2019 16:16:13 -0700

Our defense for cross-protocol attacks is ALPN.  Then key separation, and probably other things.  While layers of defense is generally a good idea, that isn't a necessary layer.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474620917

---

From: David Schinazi <[email-masked]>
Date: Tue, 19 Mar 2019 20:24:43 -0700

I agree with @kazuho's and @martinthomson's points. This was more of a belt-and-suspenders approach. That said, I still think every single deployment will actually send transport parameters, therefore requiring the extension to be present sounds simpler to implement. But I don't feel too strongly about this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474669828

---

From: Martin Thomson <[email-masked]>
Date: Tue, 19 Mar 2019 21:19:39 -0700

The question arose when we realized that you can have a perfectly functional stack with the defaults. And it was non- trivial sending any. 

However, if the client doesn't send any, it prevents the server from sending any. That seems bad.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-474678862

---

From: David Schinazi <[email-masked]>
Date: Wed, 20 Mar 2019 16:54:33 -0700

> However, if the client doesn't send any, it prevents the server from sending any. That seems bad.

That argument is more compelling than mine.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-475071991

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 27 Mar 2019 01:23:27 -0700

Discussed in Prague; no pushback against making them mandatory.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2528#issuecomment-477032701