Subject: [quicwg/base-drafts] Ben Kaduk's Transport Comment 43 (#4655)

From: Lucas Pardue <[email-masked]>
Date: Wed, 06 Jan 2021 18:06:40 -0800

@kaduk said:

> Section 21.3
>
> > Servers SHOULD provide mitigations for this attack by limiting the
> > usage and lifetime of address validation tokens; see Section 8.1.3.
>
> I recognize that it is probably an advanced implementation feature to do
> so, but implementations can also mitigate by detecting elevated rates
> across all connections or some identifiable cateogry of connections, of
> sending responses to 0-RTT data that are declared lost, treating that as
> indication of an ongoing attack, and racheting down the congestion
> window it uses for such data for the duration of the attack.  This in
> theory could improve the stability of the Internet as a whole, which
> would be the motivation for mentioning it in this document as opposed to
> leaving it at the discretion of implementors.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4655

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 22:53:30 -0800

I feel confident in leaving that to accompanying documents or follow-up work.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4655#issuecomment-755924849

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Jan 2021 20:10:20 -0800

Closed #4655.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4655#event-4193897657