Subject: [quicwg/base-drafts] Clarify definition of off-path (#4462)

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 15:47:58 -0800

We weren&#39;t being consistent.  This should help.

Next step is to ensure that our usage is consistent.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4462

-- Commit Summary --

  * Clarify definition of off-path

-- File Changes --

    M draft-ietf-quic-transport.md (25)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4462.patch
https://github.com/quicwg/base-drafts/pull/4462.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 15:50:59 -0800

@martinthomson pushed 1 commit.

123edd6acdb98396f3e144b580e9b06f73069537  Consistency in off-path usage: -transport

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462/files/78e114baa28c8be34eb0c5792893beec2c688db7..123edd6acdb98396f3e144b580e9b06f73069537

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 15:54:19 -0800

4f837ca0145b7c7cd01a47190a5b12e5d8887238  Consistency in use of off-path: -tls

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462/files/123edd6acdb98396f3e144b580e9b06f73069537..4f837ca0145b7c7cd01a47190a5b12e5d8887238

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 22 Dec 2020 15:58:49 -0800

@janaiyengar approved this pull request.

This is much better -- thank you @martinduke for catching this.

> @@ -4258,8 +4258,9 @@ Path Maximum Transmission Unit Discovery (PMTUD; {{!RFC1191}}, {{!RFC8201}})
 relies on reception of ICMP messages (e.g., IPv6 Packet Too Big messages) that
 indicate when an IP packet is dropped because it is larger than the local router
 MTU. DPLPMTUD can also optionally use these messages.  This use of ICMP messages
-is potentially vulnerable to off-path attacks that successfully guess the
-addresses used on the path and reduce the PMTU to a bandwidth-inefficient value.
+is potentially vulnerable to attacks by elements that cannot observe packets,

```suggestion
is potentially vulnerable to attacks by elements that cannot observe packets
```

> +packets that have accidentally been corrupted by the network; and only an
+entity that receives an Initial packet is able to send a valid Retry packet.

```suggestion
packets that have accidentally been corrupted by the network; only an
entity that receives an Initial packet can send a valid Retry packet.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462#pullrequestreview-557432064

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 15:59:23 -0800

9504a9fab1d12a599738996cf8ba9c0cda6d9d9e  nits

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462/files/4f837ca0145b7c7cd01a47190a5b12e5d8887238..9504a9fab1d12a599738996cf8ba9c0cda6d9d9e

---

From: martinduke <[email-masked]>
Date: Tue, 22 Dec 2020 18:40:48 -0800

@martinduke approved this pull request.

I slightly prefer the word "observe" to "receive" because of the connotation, but either way I'm satisfied. Thanks!

> @@ -4648,8 +4649,8 @@ packet it receives in the Destination Connection ID field.  The value for Source
 Connection ID MUST be copied from the Destination Connection ID of the received
 packet, which is initially randomly selected by a client.  Echoing both
 connection IDs gives clients some assurance that the server received the packet
-and that the Version Negotiation packet was not generated by an off-path
-attacker.
+and that the Version Negotiation packet was not generated by an entity that
+did not receive the Initial packet.

```suggestion
did not observe the Initial packet.
```

> @@ -1435,7 +1435,8 @@ Original Destination Connection ID:
 : The Original Destination Connection ID contains the value of the Destination
   Connection ID from the Initial packet that this Retry is in response to. The
   length of this field is given in ODCID Length. The presence of this field
-  mitigates an off-path attacker's ability to inject a Retry packet.
+  ensures that a valid Retry packet can only be sent by an entity that
+  receives the Initial packet.

```suggestion
  observes the Initial packet.
```

> @@ -1386,8 +1386,8 @@ incoming 1-RTT protected packets before the TLS handshake is complete.
 
 Retry packets (see the Retry Packet section of {{QUIC-TRANSPORT}}) carry a
 Retry Integrity Tag that provides two properties: it allows discarding
-packets that have accidentally been corrupted by the network, and it diminishes
-off-path attackers' ability to send valid Retry packets.
+packets that have accidentally been corrupted by the network; only an
+entity that receives an Initial packet can send a valid Retry packet.

```suggestion
entity that observes an Initial packet can send a valid Retry packet.
```

> @@ -4727,7 +4728,7 @@ In order to prevent tampering by version-unaware middleboxes, Initial packets
 are protected with connection- and version-specific keys (Initial keys) as
 described in {{QUIC-TLS}}.  This protection does not provide confidentiality or
 integrity against on-path attackers, but provides some level of protection
-against off-path attackers.
+against attackers that cannot also receive packets.

```suggestion
against attackers that cannot also observes packets.
```

> @@ -4727,7 +4728,7 @@ In order to prevent tampering by version-unaware middleboxes, Initial packets
 are protected with connection- and version-specific keys (Initial keys) as
 described in {{QUIC-TLS}}.  This protection does not provide confidentiality or
 integrity against on-path attackers, but provides some level of protection

```suggestion
integrity against attackers that can observe the packets, but provides some level of protection
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462#pullrequestreview-557476009

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 19:06:51 -0800

232fbb372e53e924dc3df7a8a55fc672cfdce041  a good observation

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462/files/9504a9fab1d12a599738996cf8ba9c0cda6d9d9e..232fbb372e53e924dc3df7a8a55fc672cfdce041

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Dec 2020 19:07:48 -0800

4b8f06ecbbdcfefea4b6441c71e984cd8f210c6b  Wrap

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462/files/232fbb372e53e924dc3df7a8a55fc672cfdce041..4b8f06ecbbdcfefea4b6441c71e984cd8f210c6b

---

From: Mike Bishop <[email-masked]>
Date: Mon, 28 Dec 2020 12:34:10 -0800

@MikeBishop approved this pull request.

This is an improvement.  Thanks.

> @@ -4726,8 +4727,8 @@ Packet Payload:
 In order to prevent tampering by version-unaware middleboxes, Initial packets
 are protected with connection- and version-specific keys (Initial keys) as
 described in {{QUIC-TLS}}.  This protection does not provide confidentiality or
-integrity against on-path attackers, but provides some level of protection
-against off-path attackers.
+integrity against attackers that can observe packets, but provides some level of
+protection against attackers that cannot also observes packets.

```suggestion
protection against attackers that cannot observe packets.
```

 For the purposes of this discussion, it is assumed that an off-path attacker
-has the ability to observe, modify, and re-inject a packet into the network
-that will reach the destination endpoint prior to the arrival of the original
-packet observed by the attacker. In other words, an attacker has the ability to
-consistently "win" a race with the legitimate packets between the endpoints,
-potentially causing the original packet to be ignored by the recipient.
+has the ability to observe and re-inject a modified copy of a packet into the

```suggestion
has the ability to inject a modified copy of a packet into the
```
Given that we've just talked about the observe-modify-reinject process in the previous sentence, I think we're safe to shorthand this to injecting a modified packet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4462#pullrequestreview-559292119