Subject: Re: [quicwg/base-drafts] Be more conservative about migration? (#2143)

From: Jana Iyengar <[email-masked]>
Date: Sat, 23 Mar 2019 12:51:54 -0700

Chatting with @martinduke, we may also want to add notes about potential signals of attacks in the off-path forwarding case: (i) large number of duplicates are being received from multiple addresses, (ii) PATH_RESPONSE is received from multiple addresses. These may not be actionable for everyone, but it helps implementers understand interesting signatures.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-475899395

---

From: ianswett <[email-masked]>
Date: Sat, 23 Mar 2019 16:35:14 -0700

Q: Wouldn't the sender of a PATH_CHALLENGE ignore a PATH_RESPONSE that came back from a different peer address than what they send the PATH_CHALLENGE to?

But yes, duplicate packets are insanely rare and receiving a duplicate from different addresses would almost never happen without interference, so it should be a strong signal that the immediate migration should be ignored.  Of course that makes the state machine even more complex, but assuming that duplicate arrives while a PATH_CHALLENGE is outstanding, maybe it's not that much extra complexity?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2143#issuecomment-475914005