Ben Kaduk's Transport Comment 10

[LPardue]

@kaduk said:

Section 7.2

When an Initial packet is sent by a client that has not previously
received an Initial or Retry packet from the server, the client
populates the Destination Connection ID field with an unpredictable
value. This Destination Connection ID MUST be at least 8 bytes in
length. [...]

My usual policy on seeing a random nonce shorter than 128 bits is to ask
for explanation of why the shorter value is safe for the use it is being
put to. (How bad would it be to bump this to 16?)

[martinthomson]

It's at least twice as good as the one used in TCP. As this is time-bounded and a collision even at probability 0.5 requires immense investment from an attack to engineer, this seems more than adequate for its purpose.

It is also the same size as the tokens we use for path validation. A change would be disruptive. I don't see any reason to change here.

[kaduk]

Please consider reiterating that it is time bounded in the document (and for path validation as well); I would prefer to not have future protocols attempt to refer to QUIC's 8-byte value as justification for their own when they actually need something bigger.

[janaiyengar]

@kaduk : The immediate next sentence says Until a packet is received from the server, the client MUST use the same Destination Connection ID value on all packets in this connection. That makes it clear enough I think.

[kaduk]

I don't think that helps the reader make the connection that the shorter nonce is safe due to the time bound.
But I could be wrong, of course.

[larseggert]

We need to come to a decision on this. Since this is from an IESG COMMENT (and not a DISCUSS), the editors can IMO go ahead with their preferred resolution.

[janaiyengar]

Since this comment is about how the nonce might be unsafe under other conditions, it's good enough to do nothing here.

[martinthomson]

The nonce is safe because it has been analyzed. Anyone hoping to copy what QUIC does had best understand why QUIC does what it does before doing so. If we learn that people don't exercise judgment and discretion in this, we can try to fix it next time. We can't possibility preemptively foreclose on every conceivable bad decision in this spec. It's already far too large.