Subject: [quicwg/base-drafts] Ben Kaduk's Transport Comment 42 (#4654)

From: Lucas Pardue <[email-masked]>
Date: Wed, 06 Jan 2021 18:06:15 -0800

@kaduk said:

> Section 21.2
>
> > The Source and Destination Connection ID fields are the primary means
> > of protection against off-path attack during the handshake.  These
>
> Presumably we should then give some guidance on how to generate the
> Connection IDs so that they can fulfill this role effectively.  Though it
> is likely to change significantly as a result of IETF Review,
> draft-gont-numeric-ids-sec-considerations may have some useful advice
> here.  In particular, it seems like they actually do need to be
> unpredictable in order to fulfill this role, and very short Connection
> IDs will not be very effective either.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4654

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 22:45:35 -0800

I believe that we are perfectly OK for the handshake.  We can cite Section 8.1 (again) for this (it's the third paragraph primarily).

This is deliberately not specified other places.  Mostly because it is hard, but also because any definition would be unnecessarily constraining.  I don't agree with Fernando that this absolutely needs specification.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4654#issuecomment-755921830

---

From: Jana Iyengar <[email-masked]>
Date: Thu, 07 Jan 2021 06:54:10 +0000 (UTC)

Closed #4654 via #4687.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4654#event-4178461914