Subject: Re: [quicwg/base-drafts] Add initial threat model to security considerations (#2925)

From: Eric Kinnear <[email-masked]>
Date: Sun, 03 Nov 2019 21:51:18 -0800

Thanks @mirjak! There's a section, `migration-linkability`, that discusses linkability and sets out the requirements there. I wasn't originally thinking that we wanted to duplicate that in security considerations, but it could be really good to write up some of the guarantees that we think are/n't provided there (probably in a separate issue, though).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#issuecomment-549230767

---

From: Eric Kinnear <[email-masked]>
Date: Fri, 15 Nov 2019 20:10:25 -0800

@erickinnear pushed 1 commit.

cb581002a416ac5f1ac2f2f9eb87d5b834a94141  Merge branch 'master' into ek/migration_threat_model

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/5f80f8b12d669a1dad61c27ef18c84784892d5b9..cb581002a416ac5f1ac2f2f9eb87d5b834a94141

---

From: Gorry Fairhurst <[email-masked]>
Date: Fri, 15 Nov 2019 20:57:57 -0800

gorryfair commented on this pull request.

Comments from Hackathon - basically heading in correct direction.

> +to a new endpoint as part of an established QUIC connection.
+
+
+##### On-Path Active Attacks
+
+An attacker that can cause a packet it observes to no longer reach its intended
+destination is considered an on-path attacker.  Such an attacker generally is
+present between the QUIC client and server, and a QUIC endpoint is required to
+send packets through this attacker to establish connectivity on a given path.
+
+An on-path attacker can:
+
+- Inspect packets
+- Modify IP and UDP packet headers
+- Inject new packets
+- Delay packets

Delay (includes reordering)

> +the original path between endpoints, and therefore the original packets sent by
+an endpoint are still reaching their destination.  This means that a future
+failure to route copied packets to the destination faster than their original
+path will not prevent the original packets from reaching the destination.
+
+A limited on-path attacker can:
+
+- Inspect packets
+- Inject new packets
+- Modify unencrypted packet headers
+
+A limited on-path attacker cannot:
+
+- Delay packets beyond the original packet duration
+- Drop packets
+- Modify encrypted packet payloads

he can - but they don't work

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#pullrequestreview-317952509

---

From: Eric Kinnear <[email-masked]>
Date: Fri, 15 Nov 2019 22:00:05 -0800

bda13ed1f4905a75a55f245fcdfa6835848d8ab4  Update with Gorry's comments

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/cb581002a416ac5f1ac2f2f9eb87d5b834a94141..bda13ed1f4905a75a55f245fcdfa6835848d8ab4

---

From: Eric Kinnear <[email-masked]>
Date: Fri, 15 Nov 2019 22:00:34 -0800

erickinnear commented on this pull request.

Changed in bda13ed

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347078294

---

From: Eric Kinnear <[email-masked]>
Date: Fri, 15 Nov 2019 22:00:40 -0800

+
+

Thanks! 
Changed in bda13ed

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347078297

---

From: Martin Thomson <[email-masked]>
Date: Sat, 16 Nov 2019 00:24:52 -0800

martinthomson commented on this pull request.

WIP

+TBD.
+
+### Short Headers {#short-headers-properties}
+
+TBD.
+
+### Connection Migration {#migration-properties}
+
+Connection Migration ({{migration}}) provides endpoints with the ability to
+transition between IP addresses and ports on multiple paths, using one path at a
+time for transmission and receipt of non-probing frames.  Path validation
+({{migrate-validate}}) establishes that a peer is both willing and able
+to receive packets sent on a particular path.  This helps reduce the effects of
+address spoofing, by limiting the number of packets sent to a spoofed address,
+unless an attacker is able to also receive packets sent to that address.

This can probably go, I think.

```suggestion
```

> +transition between IP addresses and ports on multiple paths, using one path at a
+time for transmission and receipt of non-probing frames.  Path validation
+({{migrate-validate}}) establishes that a peer is both willing and able
+to receive packets sent on a particular path.  This helps reduce the effects of
+address spoofing, by limiting the number of packets sent to a spoofed address,
+unless an attacker is able to also receive packets sent to that address.
+
+This section describes the intended security properties of connection migration
+when under various types of attack, as described in more detail by {{?RFC3552}}.
+
+For this purpose, attacks are divided into passive and active attacks, passive
+attackers having the capability to read packets from the network and active
+attackers having the capability to write packets into the network.
+
+Attackers are additionally categorized as either on-path attackers or off-path
+attackers (see Section 3.5 of {{?RFC3552}}); an on-path attacker is on the

```suggestion
attackers; see Section 3.5 of {{?RFC3552}}).  An on-path attacker is on the
```

> +time for transmission and receipt of non-probing frames.  Path validation
+({{migrate-validate}}) establishes that a peer is both willing and able
+to receive packets sent on a particular path.  This helps reduce the effects of
+address spoofing, by limiting the number of packets sent to a spoofed address,
+unless an attacker is able to also receive packets sent to that address.
+
+This section describes the intended security properties of connection migration
+when under various types of attack, as described in more detail by {{?RFC3552}}.
+
+For this purpose, attacks are divided into passive and active attacks, passive
+attackers having the capability to read packets from the network and active
+attackers having the capability to write packets into the network.
+
+Attackers are additionally categorized as either on-path attackers or off-path
+attackers (see Section 3.5 of {{?RFC3552}}); an on-path attacker is on the
+critical path for a given connection and can read, modify, or remove any packet

This definition of on-path uses "on the critical path".  I think that you can reduce to "can read, modify, or remove any packet [...]"

> +unless an attacker is able to also receive packets sent to that address.
+
+This section describes the intended security properties of connection migration
+when under various types of attack, as described in more detail by {{?RFC3552}}.
+
+For this purpose, attacks are divided into passive and active attacks, passive
+attackers having the capability to read packets from the network and active
+attackers having the capability to write packets into the network.
+
+Attackers are additionally categorized as either on-path attackers or off-path
+attackers (see Section 3.5 of {{?RFC3552}}); an on-path attacker is on the
+critical path for a given connection and can read, modify, or remove any packet
+it observes such that it no longer reaches its destination, while an off-path
+attacker observes the packets, but cannot prevent the original packet from
+reaching its intended destination. An off-path attacker can transmit arbitrary
+packets, and it may be able to attack the network so as to place itself on-path.

This last clause is probably worth making its own sentence.  That is,

> Properties of connection migration allow an off-path attacker to place itself on path by sending packets under certain narrow conditions.

> +Both on-path and off-path attackers can mount a passive attack in which they
+save observed QUIC packets for an offline attack against QUIC packet protection
+at a future time; this is true for any observer of any packet on any network.

Is this something that ekr should deal with?

> +save observed QUIC packets for an offline attack against QUIC packet protection
+at a future time; this is true for any observer of any packet on any network.
+
+
+#### Active Attacks
+
+An active attack ({{?RFC3552}}) involves writing data to the network.  An
+attacker with such a capability might be in a position to additionally prevent
+the original packets it observes from reaching their intended destination.  If
+so, they are considered to be an on-path attacker.
+
+An active attacker may also choose to rewrite the source or destination IP
+addresses of packets that it forwards or injects. Such spoofing attacks are only
+effective against a QUIC connection if the attacker can still forward the
+contents of the packets to the original endpoint, since QUIC connections are
+both authenticated and encrypted.

Not sure what this last bit is intended to say.  Rewriting addresses is not covered by packet protection, but this might be read to imply otherwise.

+An active attack ({{?RFC3552}}) involves writing data to the network.  An
+attacker with such a capability might be in a position to additionally prevent
+the original packets it observes from reaching their intended destination.  If
+so, they are considered to be an on-path attacker.
+
+An active attacker may also choose to rewrite the source or destination IP
+addresses of packets that it forwards or injects. Such spoofing attacks are only
+effective against a QUIC connection if the attacker can still forward the
+contents of the packets to the original endpoint, since QUIC connections are
+both authenticated and encrypted.
+
+A blind attacker, one who injects packets without being able to observe valid
+packets for a QUIC connection, is unlikely to be successful, since QUIC packet
+protection ensures that valid packets are only generated by endpoints which
+possess the key material established during the handshake.  Similarly, any

This will need a backref to the handshakey bits.

> +#### Active Attacks
+
+An active attack ({{?RFC3552}}) involves writing data to the network.  An
+attacker with such a capability might be in a position to additionally prevent
+the original packets it observes from reaching their intended destination.  If
+so, they are considered to be an on-path attacker.
+
+An active attacker may also choose to rewrite the source or destination IP
+addresses of packets that it forwards or injects. Such spoofing attacks are only
+effective against a QUIC connection if the attacker can still forward the
+contents of the packets to the original endpoint, since QUIC connections are
+both authenticated and encrypted.
+
+A blind attacker, one who injects packets without being able to observe valid
+packets for a QUIC connection, is unlikely to be successful, since QUIC packet
+protection ensures that valid packets are only generated by endpoints which

The missing observation here is that endpoints won't accept invalid packets.

+However, an attacker can modify the boundaries between QUIC packets and UDP
+datagrams, causing multiple packets to be coalesced into a single datagram, or
+splitting coalesced packets into multiple datagrams.  Such modification has no
+functional effect on a QUIC connection, however it might change the performance
+characteristics exhibited by the receiving endpoint.
+
+A spoofing attack, in which an attacker rewrites unprotected parts of a QUIC
+packet such as the source or destination address, is only effective if the
+attacker can forward packets to the original endpoint, as path validation
+({{migrate-validate}}) ensures that an endpoint's ability and willingness to
+decrypt QUIC packets is demonstrated before sending significant amounts of data
+to a new endpoint as part of an established QUIC connection.
+
+
+##### On-Path Active Attacks

I don't accept patches with five ######### in a row.  Can we bump the real stuff up a level?

> +the original packets it observes from reaching their intended destination.  If
+so, they are considered to be an on-path attacker.
+
+An active attacker may also choose to rewrite the source or destination IP
+addresses of packets that it forwards or injects. Such spoofing attacks are only
+effective against a QUIC connection if the attacker can still forward the
+contents of the packets to the original endpoint, since QUIC connections are
+both authenticated and encrypted.
+
+A blind attacker, one who injects packets without being able to observe valid
+packets for a QUIC connection, is unlikely to be successful, since QUIC packet
+protection ensures that valid packets are only generated by endpoints which
+possess the key material established during the handshake.  Similarly, any
+active attacker that observes QUIC packets and attempts to insert new data or
+modify existing data in those packets should not be able to generate packets
+deemed valid by the receiving endpoint.

This belongs in earlier sections. This is packet protection.

> +- Reorder packets
+- Drop packets
+- Split and merge datagrams along packet boundaries
+
+An on-path attacker cannot:
+
+- Modify an authenticated and encrypted portion of a packet and cause the
+ recipient to accept that packet
+
+An on-path attacker has the opportunity to modify the packets that it observes,
+however any modifications to an authenticated portion of a packet will cause it
+to be dropped by the receiving endpoint as invalid, as QUIC payloads are both
+authenticated and encrypted.
+
+In the presence of an on-path attacker, QUIC aims to provide the following
+properties.

```suggestion
properties:
```

> +A limited on-path attacker differs from an on-path attacker in that it is not on
+- Reorder packets

```suggestion
- Delay packets so that they arrive later than packets sent on the original path
```

> +### Short Headers {#short-headers-properties}
+
+TBD.
+
+### Connection Migration {#migration-properties}
+
+Connection Migration ({{migration}}) provides endpoints with the ability to
+transition between IP addresses and ports on multiple paths, using one path at a
+time for transmission and receipt of non-probing frames.  Path validation
+({{migrate-validate}}) establishes that a peer is both willing and able
+to receive packets sent on a particular path.  This helps reduce the effects of
+address spoofing, by limiting the number of packets sent to a spoofed address,
+unless an attacker is able to also receive packets sent to that address.
+
+This section describes the intended security properties of connection migration
+when under various types of attack, as described in more detail by {{?RFC3552}}.

You definitely need to constrain this section to just DoS consequences of migration.  Because this doesn't cover what an attacker might learn about communications.

+- Inspect packets
+- Inject new packets
+- Modify unencrypted packet headers
+- Reorder packets
+
+A limited on-path attacker cannot:
+
+- Delay packets beyond the original packet duration
+- Drop packets
+- Modify the authenticated and encrypted portion of a packet and cause the
+ recipient to accept that packet
+
+A limited on-path attacker can only delay packets up to the point that the
+original packets arrive before the duplicate packets, meaning that it cannot
+offer worse routing than the original path, only improved routing.  If a limited

```suggestion
offer routing with worse latency than the original path.  If a limited
```

+A limited on-path attacker cannot:
+
+- Delay packets beyond the original packet duration
+- Drop packets
+- Modify the authenticated and encrypted portion of a packet and cause the
+ recipient to accept that packet
+
+A limited on-path attacker can only delay packets up to the point that the
+original packets arrive before the duplicate packets, meaning that it cannot
+offer worse routing than the original path, only improved routing.  If a limited
+on-path attacker drops packets, the original copy will still arrive at the
+destination endpoint.
+
+In the presence of a limited on-path attacker, QUIC aims to provide the
+following properties.

```suggestion
following properties:
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#pullrequestreview-317958576

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:21:41 -0800

@erickinnear pushed 5 commits.

b589f1362bae4db4a54e74a159d0519aeedea704  First cut at handshake guarantees
b6ccaba86b3337af3b06079516a466bf34dd80ad  Text
3dd7ec9d1010ef4b73f3e2c2253b823bfc0df15e  CID protection
c2edd6a093e235823b3e60e9aa76c5d15a10c346  Apply suggestions from code review
a8a9373082d3440f3ceb95af9af3288347378535  Merge pull request #6 from ekr/migration_threat_model_todos

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/bda13ed1f4905a75a55f245fcdfa6835848d8ab4..a8a9373082d3440f3ceb95af9af3288347378535

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:37:14 -0800

Ah, good call. This is intended to say that even if you mess with the routing of the packets by changing the addresses, the packet payloads ("contents of the packets" in the wording above) are only useful to the actual endpoints that completed the handshake.
This is likely already covered by other text, so we can probably just remove it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347089887

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:44:34 -0800

Looking at this in more detail, it looks like we can move much of the definition to the beginning of the whole section, which leaves this part to be much smaller and less nested. :)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090108

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:49:04 -0800

@erickinnear pushed 2 commits.

5053e5b4114265d96ecadced811a3163834f8de2  Rewrap and typos
70dac1d725b8d021c170c5bd306ce783d7a4ea3d  Martin's review comments, starting with editorial nits

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/a8a9373082d3440f3ceb95af9af3288347378535..70dac1d725b8d021c170c5bd306ce783d7a4ea3d

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:49:39 -0800

Fixed everywhere in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090261

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:49:49 -0800

+- Inspect packets
+- Inject new packets

Fixed in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090270

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:50:02 -0800

Fixed in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090280

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:50:10 -0800

+- Drop packets

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090287

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:50:26 -0800

+

Updated in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090299

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 12:50:39 +0000 (UTC)

+

Done in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090318

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:51:02 -0800

Removed in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090354

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:51:30 -0800

Changed in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090393

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 04:51:39 -0800

+TBD.
+

Done in 70dac1d

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347090397

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:35:46 -0800

e3860d02740395e9e1400b0da8c7871c71011093  Reorganize text, move definitions up, clean up some duplication

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/70dac1d725b8d021c170c5bd306ce783d7a4ea3d..e3860d02740395e9e1400b0da8c7871c71011093

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:36:52 -0800

Moved this into short header section (and renamed that to packet protection, since technically that's not unique to SH even if this is not handshake-specific). Generally moved a bunch of text up, as well.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347091878

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:37:21 -0800

Reworded and moved this around to hopefully be more clear

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347091898

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:40:39 -0800

+
+TBD.
+

Added text to be more clear about that

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347092037

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:40:57 -0800

Moved a bunch of this up into packet protection section

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347092047

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:41:41 -0800

Moved, trimmed out the duplication, now at the top of the entire section and provides the definitions for the whole thing. Then the sections below move up one and are how those definitions, etc. apply to migration. Much better now -- thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347092070

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:41:55 -0800

Added

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925#discussion_r347092084

---

From: Eric Kinnear <[email-masked]>
Date: Sat, 16 Nov 2019 05:43:12 -0800

8d2ed7162448e2c6527733a34e838335ebe24a3a  Add reference to handshake

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2925/files/e3860d02740395e9e1400b0da8c7871c71011093..8d2ed7162448e2c6527733a34e838335ebe24a3a