Skip to content

Commit

Permalink
Merge pull request #4726 from quicwg/dont-restate-requirements
Browse files Browse the repository at this point in the history
Reword flow label generation to avoid restating RFC 6437
  • Loading branch information
janaiyengar committed Jan 12, 2021
2 parents f5b42d4 + 7b0fec2 commit fcc8855
Showing 1 changed file with 15 additions and 14 deletions.
29 changes: 15 additions & 14 deletions draft-ietf-quic-transport.md
Original file line number Diff line number Diff line change
Expand Up @@ -2755,20 +2755,21 @@ client MAY use this connection ID on any path.

## Use of IPv6 Flow-Label and Migration {#ipv6-flow-label}

Endpoints that send data using IPv6 SHOULD apply an IPv6 flow label
in compliance with {{!RFC6437}}, unless the local API does not allow
setting IPv6 flow labels.

The IPv6 flow label SHOULD be a pseudo-random function of the source and
destination addresses, source and destination UDP ports, and the Destination
Connection ID field. The flow label generation MUST be designed to minimize the
chances of linkability with a previously used flow label, as a stable flow
label would enable correlating activity on multiple paths; see
{{migration-linkability}}.

A possible implementation is to compute the flow label as a cryptographic hash
function of the source and destination addresses, source and destination
UDP ports, Destination Connection ID field, and a local secret.
Endpoints that send data using IPv6 SHOULD apply an IPv6 flow label in
compliance with {{!RFC6437}}, unless the local API does not allow setting IPv6
flow labels.

The flow label generation MUST be designed to minimize the chances of
linkability with a previously used flow label, as a stable flow label would
enable correlating activity on multiple paths; see {{migration-linkability}}.

{{?RFC6437}} suggests deriving values using a pseudorandom function to generate
flow labels. Including the Destination Connection ID field in addition to
source and destination addresses when generating flow labels ensures that
changes are synchronized with changes in other observable identifiers. A
cryptographic hash function that combines these inputs with a local secret is
one way this might be implemented.


# Connection Termination {#termination}

Expand Down

0 comments on commit fcc8855

Please sign in to comment.