Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Security Considerations for SRT hash collision attack #3005

Closed
wants to merge 6 commits into from
Closed

Add Security Considerations for SRT hash collision attack #3005

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
942e430
describe collision attack on SRTs
kazuho Sep 4, 2019
ef66d46
_hash_ collision attack
kazuho Sep 4, 2019
c36c242
it's not constant time
kazuho Sep 4, 2019
68c8254
Update draft-ietf-quic-transport.md
kazuho Sep 5, 2019
65963b0
Update draft-ietf-quic-transport.md
kazuho Sep 5, 2019
c97a030
Update draft-ietf-quic-transport.md
kazuho Sep 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion draft-ietf-quic-transport.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2527,7 +2527,7 @@ QUIC need to be aware of this and either reuse this design, or use a portion of
the packet other than the last 16 bytes for carrying data.


### Detecting a Stateless Reset
### Detecting a Stateless Reset {#detect-stateless-reset}

An endpoint detects a potential stateless reset when an incoming packet either
cannot be associated with a connection, cannot be decrypted, or is marked as a
Expand Down Expand Up @@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection
ID can be selected to route later packets to the same server.


## Hash Collision Attack on Stateless Reset Tokens

Since stateless reset tokens are generated by peers, endpoints SHOULD
be resistant to hash flooding DoS attacks when using a hash map for storing and comparing
those tokens. One way of achieving this property is to store and compare
transformed values of the stateless tokens where the transformation is defined
as a pseudo-random permutation (e.g., block cipher) or a keyed hash (e.g., HMAC
{{?RFC2104}}) that is cryptographically secure, instead of using the raw token
values as the hash keys. This approach satisfies the secure comparison
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested rephrase: "... transformed values of the stateless tokens instead of the raw token values. A transformation such as a pseudo-random permutation (e.g. block cipher) or a cryptographically-secure keyed hash (e.g., HMAC {{?RFC2104}}) can be used to also ensure that comparing stateless tokens does not leak timing information, as specified in {{detect-stateless-reset}}."

requirement in {{detect-stateless-reset}}.

# IANA Considerations

## QUIC Transport Parameter Registry {#iana-transport-parameters}
Expand Down