Subject: [quicwg/base-drafts] Erik Kline's Transport Comment 8 (#4520)

From: Lucas Pardue <[email-masked]>
Date: Tue, 05 Jan 2021 19:38:05 -0800

Erik Kline said:

> [ section 10.3 ]
> 
> * Does this "datagram ends with stateless reset token" scheme mean that
>   implementations must check the output of every packet, including post
>   encryption, and take some action if a (very low probability) collision
>   occurs (meaning the output accidentally produces this 16 byte value
>   but the packet is not intended to be a stateless reset)?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4520

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 19:53:30 -0800

I answered this via email.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4520#issuecomment-755061176

---

From: Erik Kline <[email-masked]>
Date: Tue, 05 Jan 2021 21:24:01 -0800

And that email answer made sense to me, thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4520#issuecomment-755086445

---

From: Lucas Pardue <[email-masked]>
Date: Fri, 08 Jan 2021 08:41:21 -0800

Joining the dots, Martin's email response said:

> In practice, the exception that follows means that you don't need to perform the check very often.  Most implementations only check when they are unable to decrypt or - more applicable to servers - unable to determine which connection is able to handle the packet.  The relevant text says:
> 
> > This comparison can be performed for every inbound datagram. Endpoints MAY skip this check if any packet from a datagram is successfully processed. However, the comparison MUST be performed when the first packet in an incoming datagram either cannot be associated with a connection, or cannot be decrypted.
> 
> Those that do check every datagram do run a risk of encountering a collision.  But it is tiny.
> 
> To take an extreme example, a server instance that receives ~2^62 packets for every connection (the maximum number any single connection can have, and far more than you can practically send), and you have a large number of connections (2^17 connections is a lot, but maybe plausible), and you check every inbound packet against every connection, the odds of collision are in the same ballpark as the odds that a dedicated and resourceful attacker might have to break encryption[1] at 2^-51 [2].
> 
> The Internet is big enough that this will likely happen, but I'm of the opinion that this risk is acceptable.  In any case, avoiding extra cycles has the effect of driving this probability right down.
> 
> [1] We allow 2^-57 probability.
> [2] Well, maybe a little higher, but I'm too lazy to run the birthday paradox numbers.

I'm proposing we close with no action.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4520#issuecomment-756860736

---

From: Martin Thomson <[email-masked]>
Date: Fri, 08 Jan 2021 20:22:55 -0800

Closed #4520.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4520#event-4186711453