Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More words on the minimum packet size requirement #3986

Merged
merged 2 commits into from Aug 7, 2020
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
20 changes: 9 additions & 11 deletions draft-ietf-quic-transport.md
Expand Up @@ -2888,17 +2888,15 @@ be a packet with a short header. For the stateless reset to appear as a valid
QUIC packet, the Unpredictable Bits field needs to include at least 38 bits of
data (or 5 bytes, less the two fixed bits).

A minimum size of 21 bytes does not guarantee that a stateless reset is
difficult to distinguish from other packets if the recipient requires the use of
a connection ID. To prevent a resulting stateless reset from being trivially
distinguishable from a valid packet, all packets sent by an endpoint SHOULD be
padded to at least 22 bytes longer than the minimum connection ID that the
endpoint might request that a peer include in the Destination Connection ID
field. This ensures that any stateless reset sent by the peer is
indistinguishable from a valid packet sent to the endpoint. An endpoint that
sends a stateless reset in response to a packet that is 43 bytes or less in
length SHOULD send a stateless reset that is one byte shorter than the packet it
responds to.
The resulting minimum size of 21 bytes does not guarantee that a stateless reset
is difficult to distinguish from other packets if the recipient requires the use
of a connection ID. To achieve that end, the endpoint SHOULD pad all packets it
sends to at least 22 bytes longer than the minimum connection ID that it might
request the peer to include in packets that the peer sends. This ensures that
any stateless reset sent by the peer is indistinguishable from a valid packet
sent to the endpoint. An endpoint that sends a stateless reset in response to a
packet that is 43 bytes or shorter SHOULD send a stateless reset that is one
byte shorter than the packet it responds to.

These values assume that the Stateless Reset Token is the same length as the
minimum expansion of the packet protection AEAD. Additional unpredictable bytes
Expand Down