Subject: Re: [quicwg/base-drafts] Bound 0-to-1-RTT Transition (#2466)

From: Jana Iyengar <[email-masked]>
Date: Wed, 17 Apr 2019 10:51:57 -0700

@MikeBishop @DavidSchinazi : Should we close this one in favor of #2461?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#issuecomment-484194894

---

From: David Schinazi <[email-masked]>
Date: Wed, 17 Apr 2019 12:06:24 -0700

@janaiyengar That works for me.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#issuecomment-484221301

---

From: MikkelFJ <[email-masked]>
Date: Wed, 17 Apr 2019 12:07:30 -0700

mikkelfj commented on this pull request.

> @@ -2631,7 +2641,10 @@ number 0.  Subsequent packets sent in the same packet number space MUST increase
 the packet number by at least one.
 
 0-RTT and 1-RTT data exist in the same packet number space to make loss recovery
-algorithms easier to implement between the two packet types.
+algorithms easier to implement between the two packet types.  However, a client
+MUST NOT continue sending 0-RTT packets after beginning to use 1-RTT packets.
+Servers MUST drop 0-RTT packets with greater packet numbers than the lowest
+packet number they have received in a 1-RTT packet.

Nooo: an attacker can replay old 0-RTT packets with higher packet numbers and force a close. The packets MUST be dropped.

However, I don't like the explicit drop requirement. It should happen automatically when the 0-RTT key is dropped. No reason for the server to keep track of packet numbers if the key drop is precise.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#discussion_r276391448

---

From: ianswett <[email-masked]>
Date: Wed, 17 Apr 2019 12:13:05 -0700

ianswett commented on this pull request.

An attacker can't replay any packets except Initial with a higher packet number, unless the attacker has the keys(in which case, you have bigger problems).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#discussion_r276393462

---

From: Mike Bishop <[email-masked]>
Date: Thu, 18 Apr 2019 14:33:46 -0700

I think where we've landed is that #2461 contains the principles and this has the recommended server enforcement mechanism.  I'd like to see the enforcement in that PR spelled out more explicitly, but I agree that we want the principles there.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#issuecomment-484697295

---

From: Mike Bishop <[email-masked]>
Date: Thu, 18 Apr 2019 21:33:48 +0000 (UTC)

Closed #2466.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2466#event-2286979570