Running out of NEW_CONNECTION_ID

[martinthomson]

@mirjak asked what happens if you need to send using a different connection ID, but you ran out the supply from your peer?

I think that it is possible to adopt two policies: either favour continuity at the expense of linkability, or favour unlinkability at the expense of continuing the session. We should explain this trade-off somewhere. We should also encourage the provision of an ample supply of connection IDs.

[mikkelfj]

There is also the DoS concern, forcing routing state both at endpoint and middleware.

[janaiyengar]

Discussed at editors' meeting. An endpoint can receive and process packets ok even if it doesn't have a new connection ID to use in response to a new one received. When it is about to send however, it needs to have a new connection ID (as per Section 6.7.1). If the endpoint doesn't have a new connection ID to use, we think the endpoint should immediately drop all connection state and respond to the packet with a stateless reset.

[martinthomson]

See conclusion in #1276.