Subject: [quicwg/base-drafts] Add warning about request forgery and client-side migration. Fixes #4086 (#4104)

From: ekr <[email-masked]>
Date: Wed, 16 Sep 2020 14:27:34 -0700

You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4104

-- Commit Summary --

  * Add warning about request forgery and client-side migration. Fixes #4086

-- File Changes --

    M draft-ietf-quic-transport.md (15)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4104.patch
https://github.com/quicwg/base-drafts/pull/4104.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104

---

From: ekr <[email-masked]>
Date: Wed, 16 Sep 2020 14:28:12 -0700

I also think it might be worthwhile to move much of this section to security considerations, leaving only the requirements here. @martinthomson WDYT?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104#issuecomment-693675132

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Sep 2020 17:13:35 -0700

@martinthomson approved this pull request.

Thanks for writing this up.  My only comment is that this is two points and therefore two paragraphs.

> +endpoints.  Although it is not generally possible to ensure that
+clients are not co-located with vulnerable endpoints, this version of
+QUIC does not allow servers to migrate, thus preventing spoofed
+migration attacks on clients.  Any future extension which allows
+server migration MUST also define countermeasures for forgery attacks.

```suggestion
endpoints.

Although it is not generally possible to ensure that
clients are not co-located with vulnerable endpoints, this version of
QUIC does not allow servers to migrate, thus preventing spoofed
migration attacks on clients.  Any future extension which allows
server migration MUST also define countermeasures for forgery attacks.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104#pullrequestreview-490112468

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Sep 2020 17:14:48 -0700

This is already in the security considerations section, so we're good.  Though it's hard to see, because the section is already so large.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104#issuecomment-693732276

---

From: ekr <[email-masked]>
Date: Wed, 16 Sep 2020 17:55:01 -0700

@ekr pushed 1 commit.

e0bec933660cb2c908e9db726a1c022299c0d633  Update draft-ietf-quic-transport.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104/files/647c68f039d230f6881dcd26db19ada692ffeb58..e0bec933660cb2c908e9db726a1c022299c0d633

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Sep 2020 18:16:45 -0700

@martinthomson pushed 1 commit.

b6bffb4b639f63a78efccc289f16f8d119be7b61  wrap

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104/files/e0bec933660cb2c908e9db726a1c022299c0d633..b6bffb4b639f63a78efccc289f16f8d119be7b61

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 22 Sep 2020 15:24:33 -0700

@janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104#pullrequestreview-493887836

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 22 Sep 2020 15:26:52 -0700

Merged #4104 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4104#event-3795419692