-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Don't haphazardly suggest retrying over TCP #290
Comments
Good point! |
I understand why we don't want to recommend a specific fallback, but there's an implication here we may want to keep. If you want to use QUIC with a fallback, that fallback should have roughly equivalent security properties or blocking QUIC is a downgrade attack. So the DNS example might be falling back to DNS over DTLS, but it would not be falling back to plaintext UDP. That may be better expressed in a document about which protocols could theoretically adopt QUIC than here, but I don't want to lose it entirely. Note that I'm assuming here silent fallback, where the user is never told which protocols are in use under the hood. I'm sure there are other choices for when the user is looped in, but I don't think those are QUIC's business. |
Good points Ted. I wonder whether DNS over QUIC would be done opportunistically or not. That changes the calculations too. No one currently has any real expectation that DNS is confidential (/me makes a sad face). |
I think this is input for the applicability statement. It's partly in section 2.1 of draft-kuehlewind-quic-appman but only talking about fallback to TLS/TCP. We didn't consider the DTLS/UDP case; should add that. |
I didn't recommend a specific error code for this. One of the generic ones will do. Closes #290
(This is in the context of finding that the MTU is too small.)
The text includes a very specific recommendation to use TLS over TCP for one particular case. This is unwise for two reasons:
Marked as editorial, I hope that's not controversial.
The text was updated successfully, but these errors were encountered: