Subject: [quicwg/base-drafts] Only received Stateless reset token should be checked (#2669)

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Tue, 07 May 2019 05:08:15 -0700

The current text does not explicitly say that endpoint has to check the stateless reset token received in NEW_CONNECTION_ID (and server's TP if endpoint is a client).

> The endpoint MUST
   then compare the last 16 bytes of the packet with all Stateless Reset
   Tokens that are associated with connection IDs that are currently in
   use.  This includes Stateless Reset Tokens from NEW_CONNECTION_ID
   frames and the server's transport parameters.

With this wording, I was under the impression that server can use stateless reset token in its own TP, but it seems not.

I think it would be nice to state that only received stateless reset tokens are checked.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2669

---

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Tue, 07 May 2019 05:19:36 -0700

>  The token is
   carried in the NEW_CONNECTION_ID frame sent by either peer, and
   servers can specify the stateless_reset_token transport parameter
   during the handshake (clients cannot because their transport
   parameters don't have confidentiality protection).

This text is also problematic because it suggests that endpoint can specify token sent by either peer.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2669#issuecomment-490055743