ICID or OCID?

[mikkelfj]

End of section 18, transport

A client MUST NOT include an original connection ID, a stateless reset token, or a preferred address. A server MUST treat receipt of any of these transport parameters as a connection error of type TRANSPORT_PARAMETER_ERROR.

It seems the term is "initial connection ID" not "original connection ID", at least I can't find it defined anywhere in transport.

[MikeBishop]

Two different things, but you're probably right that they should both be explicitly defined:

• The "Original destination connection ID" is the DCID used in the client's very first Initial packet. If the server responded with a Retry, the server needs to:
  • include the ODCID in the Retry packet to verify the Retry packet came from something on-path
  • include the ODCID in the eventual handshake's transport parameters to verify that the Retry packet originated from the server or something cooperating with it, not a MITM
• The "Initial connection ID" is the DCID used in the client's Initial packet to which the server responded with an Initial. This CID determines the keys used for Initial packets throughout the handshake. (But see Do Initial secrets change after Retry packet? #2823.) This CID might have been server-chosen (from a Retry) or client-chosen (no Retry).

If there's no Retry packet, they refer to the same CID, but I don't think there's a reference to the ODCID outside the context of a Retry.

[martinthomson]

I think that we already concluded this in #3011.

[MikeBishop]

This is a separate issue, about definition of these terms; #3011 is about whether these need to be separate concepts depending on the outcome of other issues.

@mikkelfj notes that the term "original connection ID" appears only to say that a client MUST NOT send one, and that literal string appears nowhere else in the document except the changelog. This refers to the transport parameter original_connection_id, whose definition matches the description of the "Original Destination Connection ID" field in Retry and references Retry, but doesn't use that term.

I'd suggest using the names of the prohibited TPs in stating the client restriction, and referencing the "Original Destination Connection ID" field by name from the TP definition.