Subject: [quicwg/base-drafts] Ben Kaduk's Transport Comment 10 (#4617)

From: Lucas Pardue <[email-masked]>
Date: Wed, 06 Jan 2021 17:06:06 -0800

@kaduk said:

> Section 7.2
>
> > When an Initial packet is sent by a client that has not previously
> > received an Initial or Retry packet from the server, the client
> > populates the Destination Connection ID field with an unpredictable
> > value.  This Destination Connection ID MUST be at least 8 bytes in
> > length.  [...]
>
> My usual policy on seeing a random nonce shorter than 128 bits is to ask
> for explanation of why the shorter value is safe for the use it is being
> put to.  (How bad would it be to bump this to 16?)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 17:39:13 -0800

It's at least twice as good as the one used in TCP.  As this is time-bounded and a collision even at probability 0.5 requires immense investment from an attack to engineer, this seems more than adequate for its purpose.

It is also the same size as the tokens we use for path validation.  A change would be disruptive.  I don't see any reason to change here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-755828431

---

From: kaduk <[email-masked]>
Date: Sat, 09 Jan 2021 20:50:57 -0800

Please consider reiterating that it is time bounded in the document (and for path validation as well); I would prefer to not have future protocols attempt to refer to QUIC's 8-byte value as justification for their own when they actually need something bigger.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-757415479

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 12 Jan 2021 16:49:34 -0800

@kaduk : The immediate next sentence says `Until a packet is received from the server, the client MUST use the same Destination Connection ID value on all packets in this connection.` That makes it clear enough I think.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-759129957

---

From: kaduk <[email-masked]>
Date: Tue, 12 Jan 2021 20:16:50 -0800

I don't think that helps the reader make the connection that the shorter nonce is safe due to the time bound.
But I could be wrong, of course.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-759194412

---

From: Lars Eggert <[email-masked]>
Date: Tue, 26 Jan 2021 03:23:41 -0800

We need to come to a decision on this. Since this is from an IESG COMMENT (and not a DISCUSS), the editors can IMO go ahead with their preferred resolution.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-767479458

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 26 Jan 2021 15:44:29 -0800

Since this comment is about how the nonce might be unsafe under *other conditions*, it's good enough to do nothing here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-767903616

---

From: Martin Thomson <[email-masked]>
Date: Tue, 26 Jan 2021 21:12:04 -0800

Closed #4617.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#event-4253974712

---

From: Martin Thomson <[email-masked]>
Date: Tue, 26 Jan 2021 21:14:50 -0800

The nonce is safe because it has been analyzed.  Anyone hoping to copy what QUIC does had best understand why QUIC does what it does before doing so.  If we learn that people don't exercise judgment and discretion in this, we can try to fix it next time.  We can't possibility preemptively foreclose on every conceivable bad decision in this spec.  It's already far too large.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4617#issuecomment-768036303