Subject: [quicwg/base-drafts] Martin Duke TLS Comment 2 (#4466)

From: Lucas Pardue <[email-masked]>
Date: Tue, 29 Dec 2020 04:40:39 -0800

@martinduke said:

> 5.8 says the ODCID field "mitigates an off-path attacker's ability to inject
> a Retry".
> 
> First, in quic-transport you defined an off-path attacker (21.1) as someone who
> can observe but not alter packets. I don't think that's what you mean here, so
> please use another a term here or explicitly define what you mean in this
> document. Come to think of it, there are some inconsistent usages of this term
> in quic-transport as well (14.2.1,17.2.1, 17.2.2 )
> 
> Secondly, it is not clear to me what protection this offers beyond the DCID
> field in the actual Retry Packet (which corresponds to the SCID of the Initial).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4466

---

From: Lucas Pardue <[email-masked]>
Date: Tue, 29 Dec 2020 04:41:49 -0800

Proposed resolution is https://github.com/quicwg/base-drafts/pull/4462

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4466#issuecomment-752061840