Subject: [quicwg/base-drafts] Explain how long Retry tokens need to be valid (#4605)

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 16:24:25 -0800

They only need to be good for one RTT.  Of course, the server doesn&#39;t
really know what the RTT is, so this isn&#39;t something firm, and I don&#39;t
want to explain ALL of that, but this should do.

Closes #4565.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4605

-- Commit Summary --

  * Explain how long Retry tokens need to be valid

-- File Changes --

    M draft-ietf-quic-transport.md (11)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4605.patch
https://github.com/quicwg/base-drafts/pull/4605.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4605

---

From: Marten Seemann <[email-masked]>
Date: Wed, 06 Jan 2021 19:21:00 -0800

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4605#pullrequestreview-563186016

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 21:38:59 -0800

@martinthomson commented on this pull request.

> @@ -2179,11 +2179,12 @@ amplification attack.
 Attackers could replay tokens to use servers as amplifiers in DDoS attacks. To
 protect against such attacks, servers MUST ensure that replay of tokens is
 prevented or limited. Servers SHOULD ensure that tokens sent in Retry packets
-are only accepted for a short time. Tokens that are provided in NEW_TOKEN frames
-({{frame-new-token}}) need to be valid for longer, but SHOULD NOT be accepted
-multiple times in a short period. Servers are encouraged to allow tokens to be
-used only once, if possible; tokens MAY include additional information about
-clients to further narrow applicability or reuse.
+are only accepted for a short time, as they are retuned immediately by clients.

```suggestion
are only accepted for a short time, as they are returned immediately by clients.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4605#pullrequestreview-563222075

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 21:39:20 -0800

@martinthomson pushed 1 commit.

816231bf333624e2918e45db26b1221f269e373b  retuning means something else

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4605/files/db91b2c0011e5247fd19a493395481b059ddf7a5..816231bf333624e2918e45db26b1221f269e373b

---

From: Jana Iyengar <[email-masked]>
Date: Thu, 07 Jan 2021 05:45:55 +0000 (UTC)

Merged #4605 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4605#event-4178285153