Subject: [quicwg/base-drafts] Delay is controllable by an attacker too (#4730)

From: Jana Iyengar <[email-masked]>
Date: Mon, 11 Jan 2021 19:58:14 -0800

Closes #4714.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4730

-- Commit Summary --

  * Delay is controllable by an attacker too

-- File Changes --

    M draft-ietf-quic-recovery.md (11)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4730.patch
https://github.com/quicwg/base-drafts/pull/4730.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730

---

From: Marten Seemann <[email-masked]>
Date: Mon, 11 Jan 2021 20:05:51 -0800

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730#pullrequestreview-565924327

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Jan 2021 20:17:22 -0800

@martinthomson approved this pull request.

Yep, it's open season on delay too.

Sorry about the suggestions.

-Congestion control fundamentally involves the consumption of signals -- both
-loss and ECN codepoints -- from unauthenticated entities.  On-path attackers can
-spoof or alter these signals.  An attacker can cause endpoints to reduce their
-sending rate by dropping packets, or alter send rate by changing ECN codepoints.
+Loss detection and congestion control fundamentally involve the consumption of
+signals -- delay, loss, and ECN codepoints -- from unauthenticated entities.
+On-path attackers can spoof or alter these signals. An attacker can cause

I think you should avoid "on-path" here.  Other types of attackers can alter these signals as well under certain conditions.

```suggestion
Attackers can spoof or alter these signals. An attacker can cause
```

-Congestion control fundamentally involves the consumption of signals -- both
-loss and ECN codepoints -- from unauthenticated entities.  On-path attackers can
-spoof or alter these signals.  An attacker can cause endpoints to reduce their
-sending rate by dropping packets, or alter send rate by changing ECN codepoints.
+Loss detection and congestion control fundamentally involve the consumption of
+signals -- delay, loss, and ECN codepoints -- from unauthenticated entities.

```suggestion
signals from unauthenticated entities.  Attackers can spoof or alter delay, loss, and ECN markings.
```

em-dash is always icky.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730#pullrequestreview-565927162

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 11 Jan 2021 23:17:05 -0800

@janaiyengar pushed 1 commit.

489fbbeff26274054dac9269be54f0a372c9f974  Update draft-ietf-quic-recovery.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730/files/2e8f6dbbeb0a56603d4c851f2536b734e8705ea1..489fbbeff26274054dac9269be54f0a372c9f974

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 11 Jan 2021 23:23:31 -0800

fe3f80a839dd2a41008d7636e6a7bf2dcdd4193c  more edit

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730/files/489fbbeff26274054dac9269be54f0a372c9f974..fe3f80a839dd2a41008d7636e6a7bf2dcdd4193c

---

From: ianswett <[email-masked]>
Date: Tue, 12 Jan 2021 14:57:43 -0800

@ianswett approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730#pullrequestreview-566770652

---

From: ianswett <[email-masked]>
Date: Tue, 12 Jan 2021 14:57:48 -0800

Merged #4730 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4730#event-4198408699