Subject: Re: [quicwg/base-drafts] Clarify that unlinkability is required for NEW_TOKEN tokens. Changes … (#2647)

From: Jana Iyengar <[email-masked]>
Date: Mon, 06 May 2019 16:43:50 -0700

janaiyengar commented on this pull request.

Looks good, modulo the minor suggestions.

>  A token SHOULD be constructed for the server to easily distinguish it from
 tokens that are sent in Retry packets as they are carried in the same field.
+The token SHOULD NOT expose linkability; i.e., information that lets observers

+1, but slight grammar: "The token MUST NOT include information that would allow it to be linked by an on-path observer to the connection on which it was issued."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#pullrequestreview-234250696

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 01:51:44 -0700

@kazuho pushed 2 commits.

ddddad19636d178ea5db06f38d7515ce2f1427d9  Merge branch 'master' into kazuho/new_token-token-encryption
67df7d17711f2012f88c0e1064dae3549f73b7e7  separate paragraph, apply suggestions from MT and Jana

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647/files/9017aaeb7924124ee93175283cb6c97ad11edf2c..67df7d17711f2012f88c0e1064dae3549f73b7e7

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 01:52:15 -0700

kazuho commented on this pull request.

Applied in 67df7d1.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#discussion_r286379737

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 01:55:22 -0700

@kazuho pushed 1 commit.

1a0be70f567fff8ada274c6d907499e3bb2b78ca  editorial improvements suggested by MT

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647/files/67df7d17711f2012f88c0e1064dae3549f73b7e7..1a0be70f567fff8ada274c6d907499e3bb2b78ca

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 01:55:55 -0700

tokens that are sent in Retry packets as they are carried in the same field.
+The token SHOULD NOT expose linkability; i.e., information that lets observers
+correlate the connection that is using the token and the one that issued the
+token.
+
+Unlike the token that is created for a Retry packet, there might be some time
+between when the token is created and when the token is subsequently used.
+Thus, a token SHOULD have an expiration time, which could be either an explicit
+expiration time or an issued timestamp that can be used to dynamically calculate
+the expiration time.  A server can retain the expiration time in the server-side

Applied in 1a0be70.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#discussion_r286381671

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 01:56:32 -0700

tokens that are sent in Retry packets as they are carried in the same field.
+The token SHOULD NOT expose linkability; i.e., information that lets observers
+correlate the connection that is using the token and the one that issued the
+token.
+
+Unlike the token that is created for a Retry packet, there might be some time
+between when the token is created and when the token is subsequently used.
+Thus, a token SHOULD have an expiration time, which could be either an explicit
+expiration time or an issued timestamp that can be used to dynamically calculate
+the expiration time.  A server can retain the expiration time in the server-side
+store, or embed the encrypted value in the token.  It is unlikely that the
+client port number is the same on two different connections; validating the port
+is therefore unlikely to be successful.

Applied in 1a0be70.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#discussion_r286381977

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 May 2019 06:48:01 -0700

Thanks @kazuho !

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#issuecomment-494810108

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 May 2019 06:48:10 -0700

Merged #2647 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2647#event-2359383719