Subject: Re: [quicwg/base-drafts] Threat model discussion does not cover handshake MITM (#3512)

From: Lucas Pardue <[email-masked]>
Date: Sat, 18 Apr 2020 05:56:58 -0700

The options for triage are close it, mark as editorial, or mark as design. 

This has a needs-discussion, and I'm seeing a lack of any discussion. So you might see where my thought process is going...

@erickinnear this relates to your PR on the QUIC threat model. Are you willing to provide some comment that helps us triage the issue?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#issuecomment-615865110

---

From: Martin Thomson <[email-masked]>
Date: Sun, 19 Apr 2020 19:44:11 -0700

I think that we can take this as editorial, as it merely requires that we capture already agreed principles (we don't protect against an adversary who can inject packets).  @erickinnear's assistance would be useful, but I can produce text if nothing is forthcoming.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#issuecomment-616278624

---

From: Eric Kinnear <[email-masked]>
Date: Sun, 19 Apr 2020 23:14:16 -0700

I can always provide comments, no guarantees on how much they'll help triage 😃 

IIRC, this is an issue filed from a comment on the threat model PR that was several-months merged to potentially increase the scope of what that covered.

I think that the original threat model that @ekr and I put together, covering the handshake and migration respectively, is intended to be the start of that section -- as additional items are discovered that could use coverage there to help clarify QUIC's stance on whatever issue, they should totally be added. I agree with @martinthomson that adding such items seem editorial, as it they aren't introducing any new requirements and are only capturing current realities as specified elsewhere.

(Of course, as that text is written, it seems logical that putting it all in words next to each other may highlight issues, and if the WG decides that we don't like how the current spec results in a particular security stance, we can open a design issue to change normative text elsewhere.)

So, I'd probably consider this editorial, and ask @mikkelfj to potentially contribute some text or clarify what he's looking to have covered by the original comment -- once that's clear, happy to help get a PR up if needed (or @martinthomson's text is always good too!).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#issuecomment-616333629

---

From: MikkelFJ <[email-masked]>
Date: Mon, 20 Apr 2020 01:39:18 -0700

Since this concerns the handshake, I'm not too confident in contributing text but I'd be happy to review and discuss.

I believe it is correct that the issue is covered in existing text elsewhere but as @erickinnear says, it makes sense to cover it in one place. The risk is that the reader is not aware how important it is to reach a certain point in the connection before trusting data, and especially to those seeking to create derived versions. From various discussions I'm not sure the importance is broadly understood.

Additionally, I'm not entirely convinced that the current text fully captures the problem - not the we necessarily can - for example various stateless transmissions / redirects / token issues - might assume a level of privacy that doesn't exist in all cases, thus requiring stronger integrity elsewhere such as in CIDs, tokens etc..

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#issuecomment-616399439

---

From: Lucas Pardue <[email-masked]>
Date: Mon, 20 Apr 2020 03:51:58 -0700

Thanks folks. It seems we have a path forward, so I'm removing the needs-discussion label. The editorial process will naturally generate some back and forth but that is the same for all editorial issues. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#issuecomment-616470705

---

From: Martin Thomson <[email-masked]>
Date: Tue, 21 Apr 2020 15:20:40 -0700

Closed #3512 via #3587.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3512#event-3258115540