Subject: [quicwg/base-drafts] Re-visit initial keys discard (#2741)

From: ekr <[email-masked]>
Date: Wed, 22 May 2019 01:28:59 -0700

This was prematurely closed and got kicked out of the design team.

Here's my proposal for how to handle this
I propose that we apply effectively the same algorithm as elsewhere: you discard initial keys when you get an ACK for a packet that was sent with the handshake key

On the server side, this will generally be at the same time, because the server will likely bundle Initial and Handshake packets, and therefore the clients' second flight will contain the ACK for the server's first handshake packet.

On the client side, it is 1-RTT later, but for the reasons I argued in the meeting, I don't think that this changes the situation: an attacker who occupies a position between the client and the server can forge a bogus partial first server flight to the client faster than the server responds. Then, as required by the current spec language, the client will discard the Initial key and be unable to receive anything from the true server, so there is already a DoS, which is not made significantly worse by the proposal above.

As Kazuho has pointed out you can do better than this by keeping multiple candidate server flights, but that's extratextual, and would be in violation of the language you quote above. I suppose if we wanted to do better, we could require:

1. The server to drop keys when it receives a handshake ACK.
2. The client to drop keys on handshake complete

But this seems more complicated.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2741

---

From: ianswett <[email-masked]>
Date: Wed, 22 May 2019 01:37:43 -0700

This was previously discussed in #1951

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2741#issuecomment-494709363

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 28 May 2019 18:07:37 -0700

The proposed change brings symmetry to how Initial keys are discarded.

FTR, during the interim some folks discussed that there's another asymmetry and that introducing symmetry there helps us resolve an open issue; at the moment only the server is allowed to replace the CID when responding to an Initial packet. We could allow clients to do that as well, and that would resolve #2645.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2741#issuecomment-496745243