diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index f43916a0d4..b3c8a85366 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -2179,11 +2179,12 @@ amplification attack. Attackers could replay tokens to use servers as amplifiers in DDoS attacks. To protect against such attacks, servers MUST ensure that replay of tokens is prevented or limited. Servers SHOULD ensure that tokens sent in Retry packets -are only accepted for a short time. Tokens that are provided in NEW_TOKEN frames -({{frame-new-token}}) need to be valid for longer, but SHOULD NOT be accepted -multiple times in a short period. Servers are encouraged to allow tokens to be -used only once, if possible; tokens MAY include additional information about -clients to further narrow applicability or reuse. +are only accepted for a short time, as they are returned immediately by clients. +Tokens that are provided in NEW_TOKEN frames ({{frame-new-token}}) need to be +valid for longer, but SHOULD NOT be accepted multiple times. Servers are +encouraged to allow tokens to be used only once, if possible; tokens MAY +include additional information about clients to further narrow applicability or +reuse. ## Path Validation {#migrate-validate}