Subject: [quicwg/base-drafts] Integrity of the data isn't mentioned at all (#4364)

From: Lars Eggert <[email-masked]>
Date: Mon, 16 Nov 2020 21:27:46 -0800

Hilarie Orman wrote:
> And integrity of the data isn't mentioned at all, perhaps because
all this is assumed to be provided by QUIC.  Section 10.2 says that
all QUIC packets are encrypted; I'm not sure if that's true, or if
QUIC has an option for "non-modifiable" without encryption. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4364

---

From: Martin Thomson <[email-masked]>
Date: Tue, 17 Nov 2020 03:16:05 -0800

Actually, we now know that this is not true, so this really needs to be fixed:

> Because all QUIC packets are encrypted, it is difficult for an attacker to control the plaintext bytes of an HTTP/3 connection, which could be used in a cross-protocol attack on a plaintext protocol.

-- from [Section 10.2](https://quicwg.org/base-drafts/draft-ietf-quic-http.html#name-cross-protocol-attacks).

The real solution here is to cite [Section 21.5](https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#name-request-forgery-attacks) of the transport draft.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4364#issuecomment-728860784

---

From: Mike Bishop <[email-masked]>
Date: Tue, 24 Nov 2020 15:44:54 -0800

The version of QUIC required by this draft is always encrypted; that seems sufficient for the original issue.  @martinthomson's issue is distinct, and worth fixing.  I'll use this issue to track it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4364#issuecomment-733300442

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 24 Nov 2020 15:47:27 -0800

... and we could add some text stating the integrity point in Section 1.2.
@MikeBishop suggests: "comparable integrity and confidentiality to TLS over TCP"

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4364#issuecomment-733304033