Subject: [quicwg/base-drafts] Inconsistency regarding future protection of version negoitation (#3828)

From: Magnus Westerlund <[email-masked]>
Date: Mon, 06 Jul 2020 01:37:29 -0700

This is for -invariants-09:

Section 6 says:

   Version Negotiation packets do not use integrity or confidentiality
   protection.  A specific QUIC version might authenticate the packet as
   part of its connection establishment process.

Is the second not contradicting what is said in previous paragraph:

    A Version Negotiation packet contains no other fields.

So to my understanding the authentication that the paragraph above talks about needs to be done in another QUIC packet, it can't be done in a QUIC packet that is Version Negotiation. Can this be made more explicit or do I misunderstand and can you then clarify why this is not a contradiction?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3828

---

From: Martin Thomson <[email-masked]>
Date: Mon, 06 Jul 2020 02:22:54 -0700

I don't think so.  The sentence here:

>  A specific QUIC version might authenticate the packet as part of its connection establishment process.

Implies that the version fields might be authenticated.  Indeed, the document says that they MUST be authenticated (somehow).

It doesn't say how.  However, this

> A Version Negotiation packet contains no other fields.

... means that it can't use any fields that are included in a Version Negotiation packet to do that.

If you look at the current proposal for [QUIC version negotiation](https://github.com/quicwg/version-negotiation), that uses transport parameters.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3828#issuecomment-654119760

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 06 Jul 2020 08:08:47 -0700

Ok, then I would request a very minor tweak in this sentence: 

 A specific QUIC version might authenticate the packet as
part of its connection establishment process.

So that it is explicit that is in another packet(s) than the Version negotiation packet. For example:

 A specific QUIC version might authenticate the version negotiation packet as
part of its connection establishment process outside of this packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3828#issuecomment-654296031

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 23:48:13 -0700

I have made a slightly larger tweak.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3828#issuecomment-655323310

---

From: Martin Thomson <[email-masked]>
Date: Tue, 14 Jul 2020 19:20:29 -0700

Closed #3828 via #3871.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3828#event-3546587463