Subject: [quicwg/base-drafts] Ben Kaduk's Transport Comment 45 (#4657)

From: Lucas Pardue <[email-masked]>
Date: Wed, 06 Jan 2021 18:07:35 -0800

@kaduk said:

> Section 21.5.2
>
> > Clients however are not obligated to use the NEW_TOKEN frame.
> > Request forgery attacks that rely on the Token field can be avoided
> > if clients send an empty Token field when the server address has
> > changed from when the NEW_TOKEN frame was received.
>
> > Clients could avoid using NEW_TOKEN if the server address changes.
> > However, not including a Token field could adversely affect
> > performance.  Servers could rely on NEW_TOKEN to enable sending of
> > data in excess of the three times limit on sending data; see
> > Section 8.1.  In particular, this affects cases where clients use
> > 0-RTT to request data from servers.
>
> This seems to be setting us up to specifically recommend trading away
> security in favor of performance.  Is that the right tradeoff?
> (Also, in the vein of my earlier comment, advanced implementation
> strategies involving detecting the presence of an attack might provide
> global benefit to the Internet, though the case is a bit weaker here
> than it was in the other situation.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4657

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 22:58:49 -0800

This is ensuring that the label on the tin is not misleading.  Where there is a trade-off, we would be irresponsible to hide that and pretend there isn't one.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4657#issuecomment-755926978

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 06 Jan 2021 23:03:10 -0800

The tradeoff exists; I don't think there is a specific suggestion here in the text. And I don't think this issue makes a suggestion of the text, does it?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4657#issuecomment-755928777

---

From: kaduk <[email-masked]>
Date: Sun, 10 Jan 2021 23:49:48 -0800

I was not intending to make a suggestion for textual change, no.  Martin framed the analysis of what's going on here better than I did -- thanks for that!  (So, close with no change.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4657#issuecomment-757682429

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Jan 2021 20:05:24 -0800

Closed #4657.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4657#event-4193888567