Subject: [quicwg/base-drafts] Minimum size (#3848)

From: ekr <[email-masked]>
Date: Tue, 07 Jul 2020 18:51:59 -0700

> A minimum size of 21 bytes does not guarantee that a stateless reset is
difficult to distinguish from other packets if the recipient requires the use of
a connection ID.  To prevent a resulting stateless reset from being trivially
distinguishable from a valid packet, all packets sent by an endpoint SHOULD be
padded to at least 22 bytes longer than the minimum connection ID that the
endpoint might use. 

I don't quite understand how this text works because I don't get to control the CIDs that I send with.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3848

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 19:04:21 -0700

Would this be clearer if it said:

> all packets sent by an endpoint SHOULD be padded to at least 22 bytes longer than the minimum connection ID that the endpoint might request a peer to use.

?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3848#issuecomment-655236040

---

From: ekr <[email-masked]>
Date: Tue, 07 Jul 2020 19:26:02 -0700

I feel like maybe I'm having trouble understanding the reasoning here. Do you mind walking me through it?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3848#issuecomment-655242411

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 21:34:21 -0700

The logic is a little turgid and I think we were reluctant to show our working.

The sender of a stateless reset can't know how big a connection ID the peer might have requested it use.

This makes packets potentially distinguishable a peer wanted the largest connection ID size (20) and the packet size drops below 41 bytes.

The sender of a stateless reset is required to reduce packet size for the stateless reset, unless it is counting somehow.

So, if an endpoint wants to ensure that a peer can generate an indistinguishable stateless reset, assuming that its peer is following the size reduction rule, and assuming that the reduction is just one byte (because the stateless reset sender also wants it to be indistinguishable), then it needs to send packets of at least 42 bytes in the general case.  But if it knows that it would never ever ask for a connection ID larger than N, then it can instead send packets of size N+22 and the goal is accomplished without sending larger packets all the time.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3848#issuecomment-655277560