Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cross-protocol attacks are maybe possible #4427

Merged
merged 2 commits into from
Dec 8, 2020
Merged

Cross-protocol attacks are maybe possible #4427

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
406b636
Cross-protocol attacks are maybe possible
martinthomson Dec 8, 2020
7d260ad
Update intro bits for confidentiality/integrity
martinthomson Dec 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions draft-ietf-quic-http.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,8 +128,9 @@ control, similar to that provided by the HTTP/2 framing layer. By providing
reliability at the stream level and congestion control across the entire
connection, QUIC has the capability to improve the performance of HTTP compared
to a TCP mapping. QUIC also incorporates TLS 1.3 ({{?TLS13=RFC8446}}) at the
transport layer, offering comparable security to running TLS over TCP, with the
improved connection setup latency of TCP Fast Open ({{?TFO=RFC7413}}).
transport layer, offering comparable confidentiality and integrity to running
TLS over TCP, with the improved connection setup latency of TCP Fast Open
({{?TFO=RFC7413}}).

This document defines a mapping of HTTP semantics over the QUIC transport
protocol, drawing heavily on the design of HTTP/2. While delegating stream
Expand Down Expand Up @@ -1811,10 +1812,13 @@ of establishing authority are discussed in Section 16.1 of {{!SEMANTICS}}.
## Cross-Protocol Attacks

The use of ALPN in the TLS and QUIC handshakes establishes the target
application protocol before application-layer bytes are processed. Because all
QUIC packets are encrypted, it is difficult for an attacker to control the
plaintext bytes of an HTTP/3 connection, which could be used in a cross-protocol
attack on a plaintext protocol.
application protocol before application-layer bytes are processed. This ensures
that endpoints have strong assurances that peers are using the same protocol.

This does not guarantee protection from all cross-protocol attacks. Section
21.5 of {{QUIC-TRANSPORT}} describes some ways in which the plaintext of QUIC
packets can be used to perform request forgery against endpoints that don't use
authenticated transports.

## Intermediary Encapsulation Attacks

Expand Down