Subject: [quicwg/base-drafts] Attempt to make the stateless reset text better (#3007)

From: Martin Thomson <[email-masked]>
Date: Thu, 05 Sep 2019 20:31:39 -0700

PR #2927 had a mistake in it, and some very confusing language.  The rules for generating stateless resets was all mixed up in some complementary rules about generating packets that might trigger stateless resets.

This attempts to split out the rules for generating stateless resets (minimum size is 5 + 16 = 21), and for generating packets that might trigger a stateless reset (min_cid + 22).
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3007

-- Commit Summary --

  * Attempt to make the stateless reset text better
  * More editorial changes

-- File Changes --

    M draft-ietf-quic-transport.md (48)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3007.patch
https://github.com/quicwg/base-drafts/pull/3007.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007

---

From: MikkelFJ <[email-masked]>
Date: Thu, 05 Sep 2019 21:46:53 -0700

Do we need discussion on the fixed QUIC header bit in the triggering packet and outgoing reset packet?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#issuecomment-528706518

---

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 09:47:17 -0700

ianswett approved this pull request.

> -packet protection AEAD.  More unpredictable bytes might be necessary if the
-endpoint could have negotiated a packet protection scheme with a larger minimum
-AEAD expansion.
-
-An endpoint SHOULD NOT send a stateless reset that is significantly larger than
-the packet it receives.  Endpoints MUST discard packets that are too small to be
-valid QUIC packets.  With the set of AEAD functions defined in {{QUIC-TLS}},
-packets that are smaller than 21 bytes are never valid.
+To entities other than its intended recipient, a stateless reset will appear to
+be a packet with a short header.  For the stateless reset to appear as a valid
+QUIC packet, the Unpredictable Bits field needs to include at least 38 bits of
+data (or 6 bytes, less the two fixed bits).
+
+A minimum size of 21 bytes does not guarantee that a stateless reset is
+difficult to distinguish from other packets if the recipient requires the use of
+a connection ID.  In order to ensure that a stateless reset that appears to be

This second sentence is hard to follow.  How about "To prevent a resulting stateless reset from being distinguished from a valid packet, all packets ..."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#pullrequestreview-284979270

---

From: Martin Thomson <[email-masked]>
Date: Sun, 08 Sep 2019 18:11:16 -0700

@martinthomson pushed 1 commit.

967bbe7b5d2c953b04cc4bc9333c817cce75b5cf  Taking Ian's rewording

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007/files/6048b49dc4316683a4e35584d58aabb16719a6ce..967bbe7b5d2c953b04cc4bc9333c817cce75b5cf

---

From: ianswett <[email-masked]>
Date: Mon, 09 Sep 2019 15:03:05 +0000 (UTC)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#pullrequestreview-285574593

---

From: martinduke <[email-masked]>
Date: Mon, 09 Sep 2019 09:34:37 -0700

martinduke approved this pull request.

I believe this PR addresses the stated issue, which is that the text is unclear.

However, I am still concerned about the security properties of this design.

> -16 bytes for AEAD expansion, and an extra byte to allow the peer to
-send a smaller stateless reset than the packet it receives.
-
-The Stateless Reset Token corresponds to the minimum expansion of the

5 bytes

-valid QUIC packets.  With the set of AEAD functions defined in {{QUIC-TLS}},
-packets that are smaller than 21 bytes are never valid.
+To entities other than its intended recipient, a stateless reset will appear to
+be a packet with a short header.  For the stateless reset to appear as a valid
+QUIC packet, the Unpredictable Bits field needs to include at least 38 bits of
+data (or 6 bytes, less the two fixed bits).
+
+A minimum size of 21 bytes does not guarantee that a stateless reset is
+difficult to distinguish from other packets if the recipient requires the use of
+a connection ID.  To prevent a resulting stateless reset from being trivially
+distinguishable from a valid packet, all packets sent by an endpoint SHOULD be
+padded to at least 22 bytes longer than the minimum connection ID that the
+endpoint might use.  An endpoint that sends a stateless reset in response to
+packet that is 43 bytes or less in length SHOULD send a stateless reset that is
+one byte shorter than the packet it responds to.

at least one byte?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#pullrequestreview-285625384

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Sep 2019 17:12:18 -0700

b88ee12bc752eee3a8c2a0564fdbf2c04ddbdddd  (38+2)/8 != 6

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007/files/967bbe7b5d2c953b04cc4bc9333c817cce75b5cf..b88ee12bc752eee3a8c2a0564fdbf2c04ddbdddd

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Sep 2019 17:12:28 -0700

martinthomson commented on this pull request.

oops

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#discussion_r322505274

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Sep 2019 17:13:30 -0700

This is precisely one.  If the sender is following their side and sending the absolute minimum, then you can't go smaller without the resulting packet becoming obviously invalid.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#discussion_r322505449

---

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Sep 2019 17:15:45 -0700

@martinduke if you can lay out what you think the security concerns are in another issue, that would helpful.  I realize that there are plenty of compromises in this design, which make this less than ideal.  But first I'd like to try to understand where you think this is falling short.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#issuecomment-529715076

---

From: Martin Thomson <[email-masked]>
Date: Tue, 10 Sep 2019 15:11:16 -0700

Merged #3007 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3007#event-2623851869