Subject: [quicwg/base-drafts] Avoid generating overlapping CIDs? (#4065)

From: martinduke <[email-masked]>
Date: Mon, 31 Aug 2020 17:49:21 -0700

This may be stupid and is definitely editorial, but should we provide advice for an endpoint to not do the following:

CID for connection 1: 0x34a3f036
CID for connection 2: 0x34a3f036a2
?

It would be crazy to do this intentionally, but if an endpoint randomly generates CIDs with differing lengths, it probably ought to catch the case, or otherwise implement trial decryption.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4065

---

From: Lars Eggert <[email-masked]>
Date: Mon, 31 Aug 2020 23:07:17 -0700

I don't quite see the problem. In a long header, there is the CID length, so there is no confusion. In a short header, the implementation needs a way to derive the CID length implicitly, e.g., by only using one length or through some other means. That means an implementation can always distinguish the two? In other words, when it can't, it's buggy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4065#issuecomment-684406704

---

From: Martin Thomson <[email-masked]>
Date: Mon, 31 Aug 2020 23:18:27 -0700

@martinduke's example is clearly ambiguous, but I don't think we need to document it.  It's pretty clear that connections wouldn't survive very long if this happened.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4065#issuecomment-684424954