Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NEW_TOKEN contains globally unique values #3281

Merged
merged 4 commits into from
Dec 11, 2019
Merged

NEW_TOKEN contains globally unique values #3281

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
18e24e2
NEW_TOKEN contains globally unique values
martinthomson Dec 3, 2019
932d505
Paraphrase suggestions
martinthomson Dec 8, 2019
8a400b4
Reword, thanks @janaiyengar
martinthomson Dec 10, 2019
cd6fcba
Update draft-ietf-quic-transport.md
janaiyengar Dec 11, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions draft-ietf-quic-transport.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1719,9 +1719,11 @@ encrypted form in the token.
A token issued with NEW_TOKEN MUST NOT include information that would allow
values to be linked by an on-path observer to the connection on which it was
issued, unless the values are encrypted. For example, it cannot include the
previous connection ID or addressing information. Information that allows the
server to distinguish between tokens from Retry and NEW_TOKEN MAY be accessible
to entities other than the server.
previous connection ID or addressing information. A server MUST ensure that
every NEW_TOKEN frame it sends is unique across all clients, with the exception
of those sent to repair losses of previously sent NEW_TOKEN frames. Information
that allows the server to distinguish between tokens from Retry and NEW_TOKEN
MAY be accessible to entities other than the server.

It is unlikely that the client port number is the same on two different
connections; validating the port is therefore unlikely to be successful.
Expand Down Expand Up @@ -5067,8 +5069,9 @@ Token:
an empty Token field as a connection error of type FRAME_ENCODING_ERROR.

An endpoint might receive multiple NEW_TOKEN frames that contain the same token
value. Endpoints are responsible for discarding duplicate values, which might
be used to link connection attempts; see {{validate-future}}.
value if packets containing the frame are incorrectly determined to be lost.
Endpoints are responsible for discarding duplicate values, which might be used
to link connection attempts; see {{validate-future}}.

Clients MUST NOT send NEW_TOKEN frames. Servers MUST treat receipt of a
NEW_TOKEN frame as a connection error of type PROTOCOL_VIOLATION.
Expand Down