From 59c6be51ed13e20b7bb140cd1525cebad4cf93be Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 16:20:06 +1000 Subject: [PATCH 01/16] Final batch of text changes for transport Now I have to scrub the XML... --- draft-ietf-quic-transport.md | 314 +++++++++++++++++------------------ 1 file changed, 152 insertions(+), 162 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index f19b33a50c..b6a8419edd 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -73,6 +73,7 @@ normative: role: editor TLS13: RFC8446 + RFC8126: informative: @@ -6545,26 +6546,25 @@ descriptions of known attacks and countermeasures. A complete security analysis of QUIC is outside the scope of this document. This section provides an informal description of the desired security properties -as an aid to implementors and to help guide protocol analysis. +as an aid to implementers and to help guide protocol analysis. QUIC assumes the threat model described in {{?SEC-CONS=RFC3552}} and provides protections against many of the attacks that arise from that model. For this purpose, attacks are divided into passive and active attacks. Passive -attackers have the capability to read packets from the network, while active -attackers also have the capability to write packets into the network. However, -a passive attack could involve an attacker with the ability to cause a routing +attackers have the ability to read packets from the network, while active +attackers also have the ability to write packets into the network. However, a +passive attack could involve an attacker with the ability to cause a routing change or other modification in the path taken by packets that comprise a connection. Attackers are additionally categorized as either on-path attackers or off-path -attackers. An on-path attacker can read, -modify, or remove any packet it observes such that it no longer reaches its -destination, while an off-path attacker observes the packets, but cannot prevent -the original packet from reaching its intended destination. Both types of -attackers can also transmit arbitrary packets. This definition differs from -that of {{Section 3.5 of SEC-CONS}} in that an off-path attacker is able to -observe packets. +attackers. An on-path attacker can read, modify, or remove any packet it +observes such that the packet no longer reaches its destination, while an +off-path attacker observes the packets but cannot prevent the original packet +from reaching its intended destination. Both types of attackers can also +transmit arbitrary packets. This definition differs from that of {{Section 3.5 +of SEC-CONS}} in that an off-path attacker is able to observe packets. Properties of the handshake, protected packets, and connection migration are considered separately. @@ -6625,7 +6625,7 @@ new connection establishment without incurring this cost. An on-path or off-path attacker can force a handshake to fail by replacing or racing Initial packets. Once valid Initial packets have been exchanged, -subsequent Handshake packets are protected with the handshake keys and an +subsequent Handshake packets are protected with the Handshake keys and an on-path attacker cannot force handshake failure other than by dropping packets to cause endpoints to abandon the attempt. @@ -6665,14 +6665,14 @@ Both on-path and off-path attackers can mount a passive attack in which they save observed packets for an offline attack against packet protection at a future time; this is true for any observer of any packet on any network. -A blind attacker, one who injects packets without being able to observe valid -packets for a connection, is unlikely to be successful, since packet protection -ensures that valid packets are only generated by endpoints that possess the -key material established during the handshake; see {{handshake}} and -{{handshake-properties}}. Similarly, any active attacker that observes packets +An attacker that injects packets without being able to observe valid packets for +a connection is unlikely to be successful, since packet protection ensures that +valid packets are only generated by endpoints that possess the key material +established during the handshake; see Sections {{ Date: Fri, 30 Apr 2021 16:53:53 +1000 Subject: [PATCH 02/16] Asides --- draft-ietf-quic-transport.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index b6a8419edd..bab4c0a68b 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -6602,12 +6602,12 @@ Prior to address validation, endpoints are limited in what they are able to send. Endpoints cannot send data toward an unvalidated address in excess of three times the data received from that address. -Note: - -: The anti-amplification limit only applies when an endpoint responds to packets - received from an unvalidated address. The anti-amplification limit does not - apply to clients when establishing a new connection or when initiating - connection migration. + #### Server-Side DoS @@ -7166,11 +7166,11 @@ send datagrams that match these patterns prior to validating the destination address. Endpoints MAY retire connection IDs containing patterns known to be problematic without using them. -Note: - -: Modifying endpoints to apply these protections is more efficient than - deploying network-based protections, as endpoints do not need to perform - any additional processing when sending to an address that has been validated. + ## Slowloris Attacks From add9e2ff01c05ce1515dfd6cd76f3ed56a62cabd Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 17:59:00 +1000 Subject: [PATCH 03/16] Clarify without (1) and (2) --- draft-ietf-quic-transport.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index bab4c0a68b..988f54d415 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -6782,8 +6782,8 @@ consistently "win" a race with the legitimate packets between the endpoints, potentially causing the original packet to be ignored by the recipient. It is also assumed that an attacker has the resources necessary to affect NAT -state, potentially both causing an endpoint to lose its NAT binding, and an -attacker to obtain the same port for use with its traffic. +state. In particular, an attacker can cause an endpoint to lose its NAT binding +and then obtain the same port for use with its own traffic. In the presence of an off-path attacker, QUIC aims to provide the following properties: From 066d7c8943bfe730141c6284401f4127cfd151a5 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:01:19 +1000 Subject: [PATCH 04/16] Compact dl --- draft-ietf-quic-transport.md | 1 + 1 file changed, 1 insertion(+) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index 988f54d415..cfc119692a 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7387,6 +7387,7 @@ Contact: Notes: : Supplementary notes about the registration. +{: spacing="compact"} Provisional registrations MAY omit the Specification and Notes fields, plus any additional fields that might be required for a permanent registration. The Date From 4a353030d00417319300640845ec37da48ccdbe4 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:01:34 +1000 Subject: [PATCH 05/16] Use of is not really right, it's requests for --- draft-ietf-quic-transport.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index cfc119692a..e06dfc9d72 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7397,7 +7397,7 @@ date the registration is created or updated. ### Selecting Codepoints {#iana-random} -New uses of codepoints from QUIC registries SHOULD use a randomly selected +New requests for codepoints from QUIC registries SHOULD use a randomly selected codepoint that excludes both existing allocations and the first unallocated codepoint in the selected space. Requests for multiple codepoints MAY use a contiguous range. This minimizes the risk that differing semantics are From d6647cc616ef40b514ffa5d97cb6a0fba002d58d Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:02:44 +1000 Subject: [PATCH 06/16] just version negotiation --- draft-ietf-quic-transport.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index e06dfc9d72..80c060228b 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7485,7 +7485,7 @@ policy ({{Section 4.6 of RFC8126}}). The codepoint of 0x00000001 to the protocol is assigned with permanent status to the protocol defined in this document. The codepoint of 0x00000000 is permanently reserved; the note for this codepoint indicates that this version is -reserved for Version Negotiation. +reserved for version negotiation. All codepoints that follow the pattern 0x?a?a?a?a are reserved and MUST NOT be assigned by IANA, and MUST NOT appear in the listing of assigned values. From 90455c4e3bde66d7a5ae7095e2907ebb5b158b5a Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:07:35 +1000 Subject: [PATCH 07/16] It's a type name --- draft-ietf-quic-transport.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index 80c060228b..36cb856857 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7550,7 +7550,7 @@ which are assigned using Standards Action or IESG Approval as defined in In addition to the fields in {{iana-provisional}}, permanent registrations in this registry MUST include the following field: -Frame Name: +Frame Type Name: : A short mnemonic for the frame type. From 103137d9dfb3deb43fa024193caf2c6c857a8829 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:08:13 +1000 Subject: [PATCH 08/16] Ranges not regions --- draft-ietf-quic-transport.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index 36cb856857..c7d360cd79 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7572,7 +7572,7 @@ IANA has added a registry for "QUIC Transport Error Codes" under a "QUIC" heading. The "QUIC Transport Error Codes" registry governs a 62-bit space. This space is -split into three regions that are governed by different policies. Permanent +split into three ranges that are governed by different policies. Permanent registrations in this registry are assigned using the Specification Required policy ({{Section 4.6 of RFC8126}}), except for values between 0x00 and 0x3f (in hexadecimal), inclusive, which are assigned using Standards Action or IESG From fa80452f831c564bc218084bad31396b9cb2742e Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:09:49 +1000 Subject: [PATCH 09/16] pseudocode markings --- draft-ietf-quic-transport.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index c7d360cd79..148ec56cde 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7631,7 +7631,7 @@ The pseudocode in {{alg-varint}} shows how a variable-length integer can be read from a stream of bytes. The function ReadVarint takes a single argument -- a sequence of bytes, which can be read in network byte order. -~~~ +~~~pseudocode ReadVarint(data): // The length of variable-length integers is encoded in the // first two bits of the first byte. @@ -7665,7 +7665,7 @@ The EncodePacketNumber function takes two arguments: * largest_acked is the largest packet number that has been acknowledged by the peer in the current packet number space, if any. -~~~ +~~~pseudocode EncodePacketNumber(full_pn, largest_acked): // The number of bits must be at least one more @@ -7680,7 +7680,7 @@ EncodePacketNumber(full_pn, largest_acked): num_bytes = ceil(min_bits / 8) // Encode the integer value and truncate to - // the num_bytes least-significant bytes. + // the num_bytes least significant bytes. return encode(full_pn, num_bytes) ~~~ {: #alg-encode-pn title="Sample Packet Number Encoding Algorithm"} @@ -7707,7 +7707,7 @@ The DecodePacketNumber function takes three arguments: * truncated_pn is the value of the Packet Number field. * pn_nbits is the number of bits in the Packet Number field (8, 16, 24, or 32). -~~~ +~~~pseudocode DecodePacketNumber(largest_pn, truncated_pn, pn_nbits): expected_pn = largest_pn + 1 pn_win = 1 << pn_nbits From 865e3e6791afdaa829b77d39363016ef321a1309 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Fri, 30 Apr 2021 18:10:44 +1000 Subject: [PATCH 10/16] Clarify sentence --- draft-ietf-quic-transport.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index 148ec56cde..e15fdd2aaf 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -7766,9 +7766,9 @@ provide a clear indication of how the path treats marked packets. {{ecn-validation}} suggests limiting this to ten packets or three times the PTO. After the testing period ends, the ECN state for the path becomes "unknown". -From the "unknown" state, successful validation of the ECN counts an ACK frame -(see {{ecn-ack}}) causes the ECN state for the path to become "capable", unless -no marked packet has been acknowledged. +From the "unknown" state, successful validation of the ECN counts in an ACK +frame (see {{ecn-ack}}) causes the ECN state for the path to become "capable" +unless no marked packet has been acknowledged. If validation of ECN counts fails at any time, the ECN state for the affected path becomes "failed". An endpoint can also mark the ECN state for a path as From 8587cd6d451aaa1ebfbd995045f36e4c24f12a03 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Mon, 3 May 2021 10:39:56 +1000 Subject: [PATCH 11/16] ~ Co-authored-by: Jana Iyengar --- draft-ietf-quic-transport.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md index e15fdd2aaf..94985f7433 100644 --- a/draft-ietf-quic-transport.md +++ b/draft-ietf-quic-transport.md @@ -6882,7 +6882,7 @@ that are received on a different network path. The Source and Destination Connection ID fields are the primary means of protection against off-path attack during the handshake; see {{validate-handshake}}. These are required to match those set by a peer. -Except for Initial and stateless reset packets, an endpoint only accepts +Except for Initial and Stateless Reset packets, an endpoint only accepts packets that include a Destination Connection ID field that matches a value the endpoint previously chose. This is the only protection offered for Version Negotiation packets. @@ -7605,7 +7605,7 @@ The initial contents of this registry are shown in {{iana-error-table}}. | 0x08 | TRANSPORT_PARAMETER_ERROR | Error in transport parameters | {{error-codes}} | | 0x09 | CONNECTION_ID_LIMIT_ERROR | Too many connection IDs received | {{error-codes}} | | 0x0a | PROTOCOL_VIOLATION | Generic protocol violation | {{error-codes}} | -| 0x0b | INVALID_TOKEN | Invalid Token received | {{error-codes}} | +| 0x0b | INVALID_TOKEN | Invalid token received | {{error-codes}} | | 0x0c | APPLICATION_ERROR | Application error | {{error-codes}} | | 0x0d | CRYPTO_BUFFER_EXCEEDED | CRYPTO data buffer overflowed | {{error-codes}} | | 0x0e | KEY_UPDATE_ERROR | Invalid packet protection update | {{error-codes}} | From 8d91ee64017a6559ff4dcf5193c321d24c9b978d Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Mon, 3 May 2021 15:39:35 +1000 Subject: [PATCH 12/16] Aim to constrain attackers --- rfc9000.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/rfc9000.md b/rfc9000.md index aba2383be6..78405ce0c3 100644 --- a/rfc9000.md +++ b/rfc9000.md @@ -6697,8 +6697,7 @@ however, any modifications to an authenticated portion of a packet will cause it to be dropped by the receiving endpoint as invalid, as packet payloads are both authenticated and encrypted. -In the presence of an on-path attacker, QUIC aims to provide the following -properties: +QUIC aims to constrain the capabilities of an on-path attacker as follows: 1. An on-path attacker can prevent use of a path for a connection, causing the connection to fail if it cannot use a different path that does not @@ -6753,8 +6752,7 @@ It is also assumed that an attacker has the resources necessary to affect NAT state. In particular, an attacker can cause an endpoint to lose its NAT binding and then obtain the same port for use with its own traffic. -In the presence of an off-path attacker, QUIC aims to provide the following -properties: +QUIC aims to constrain the capabilities of an off-path attacker as follows: 1. An off-path attacker can race packets and attempt to become a "limited" on-path attacker. @@ -6810,8 +6808,7 @@ offer routing with worse latency than the original path. If a limited on-path attacker drops packets, the original copy will still arrive at the destination endpoint. -In the presence of a limited on-path attacker, QUIC aims to provide the -following properties: +QUIC aims to constrain the capabilities of a limited off-path attacker as follows: 1. A limited on-path attacker cannot cause a connection to close once the handshake has completed. From a9587d3bdf26849d8e27122823512018118d7377 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Mon, 3 May 2021 16:03:49 +1000 Subject: [PATCH 13/16] Some consistency edits --- rfc9000.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/rfc9000.md b/rfc9000.md index 78405ce0c3..4122e4a729 100644 --- a/rfc9000.md +++ b/rfc9000.md @@ -4611,8 +4611,8 @@ Packet Number Length: : In packet types that contain a Packet Number field, the least significant two bits (those with a mask of 0x03) of byte 0 contain the length of the packet number, encoded as an unsigned, two-bit integer that is one less than the - length of the packet number field in bytes. That is, the length of the packet - number field is the value of this field, plus one. These bits are protected + length of the Packet Number field in bytes. That is, the length of the Packet + Number field is the value of this field, plus one. These bits are protected using header protection; see {{Section 5.4 of QUIC-TLS}}. Length: @@ -4623,9 +4623,9 @@ Length: Packet Number: -: The packet number field is 1 to 4 bytes long. The packet number is protected +: The Packet Number field is 1 to 4 bytes long. The packet number is protected using header protection; see {{Section 5.4 of QUIC-TLS}}. The length of the - packet number field is encoded in the Packet Number Length bits of byte 0; see + Packet Number field is encoded in the Packet Number Length bits of byte 0; see above. ### Version Negotiation Packet {#packet-version} @@ -5074,8 +5074,8 @@ Packet Number Length: : The least significant two bits (those with a mask of 0x03) of byte 0 contain the length of the packet number, encoded as an unsigned, two-bit integer that - is one less than the length of the packet number field in bytes. That is, the - length of the packet number field is the value of this field, plus one. These + is one less than the length of the Packet Number field in bytes. That is, the + length of the Packet Number field is the value of this field, plus one. These bits are protected using header protection; see {{Section 5.4 of QUIC-TLS}}. Destination Connection ID: @@ -5085,9 +5085,9 @@ Destination Connection ID: Packet Number: -: The packet number field is 1 to 4 bytes long. The packet number is protected +: The Packet Number field is 1 to 4 bytes long. The packet number is protected using header protection; see - {{Section 5.4 of QUIC-TLS}}. The length of the packet number field is encoded + {{Section 5.4 of QUIC-TLS}}. The length of the Packet Number field is encoded in Packet Number Length field. See {{packet-encoding}} for details. Packet Payload: @@ -7496,7 +7496,7 @@ The initial contents of this registry are shown in {{iana-tp-table}}. | 0x10 | retry_source_connection_id | {{transport-parameter-definitions}} | {: #iana-tp-table title="Initial QUIC Transport Parameters Registry Entries"} -Each value of the format `31 * N + 27` for integer values of N (that is, 27, 58, +Each value of the form `31 * N + 27` for integer values of N (that is, 27, 58, 89, ...) are reserved; these values MUST NOT be assigned by IANA and MUST NOT appear in the listing of assigned values. From ae0f8628dd5a61be899ed39199d36b5b58ca36aa Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Mon, 3 May 2021 16:16:39 +1000 Subject: [PATCH 14/16] Wrap --- rfc9000.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rfc9000.md b/rfc9000.md index 4122e4a729..cc2b817a4b 100644 --- a/rfc9000.md +++ b/rfc9000.md @@ -6808,7 +6808,8 @@ offer routing with worse latency than the original path. If a limited on-path attacker drops packets, the original copy will still arrive at the destination endpoint. -QUIC aims to constrain the capabilities of a limited off-path attacker as follows: +QUIC aims to constrain the capabilities of a limited off-path attacker as +follows: 1. A limited on-path attacker cannot cause a connection to close once the handshake has completed. From d7abcd1da1ec06b324f7454481bbe2afe874c294 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Wed, 5 May 2021 08:34:54 +1000 Subject: [PATCH 15/16] Missed one --- rfc9000.md | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/rfc9000.md b/rfc9000.md index 0bbf168d26..ad49510d08 100644 --- a/rfc9000.md +++ b/rfc9000.md @@ -5091,16 +5091,11 @@ Key Phase: Packet Number Length: : The least significant two bits (those with a mask of 0x03) of byte 0 contain -<<<<<<< HEAD - the length of the packet number, encoded as an unsigned, two-bit integer that - is one less than the length of the Packet Number field in bytes. That is, the - length of the Packet Number field is the value of this field, plus one. These -======= - the length of the packet number, encoded as an unsigned two-bit integer that - is one less than the length of the packet number field in bytes. That is, the - length of the packet number field is the value of this field plus one. These ->>>>>>> origin/master - bits are protected using header protection; see {{Section 5.4 of QUIC-TLS}}. + the length of the Packet Number field, encoded as an unsigned two-bit integer + that is one less than the length of the packet number field in bytes. That + is, the length of the packet number field is the value of this field plus one. + These bits are protected using header protection; see {{Section 5.4 of + QUIC-TLS}}. Destination Connection ID: From 7d209a29818251e396fd1875b1b2dfee8af66208 Mon Sep 17 00:00:00 2001 From: Martin Thomson Date: Wed, 5 May 2021 08:35:51 +1000 Subject: [PATCH 16/16] capitalize --- rfc9000.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rfc9000.md b/rfc9000.md index ad49510d08..f37f16630d 100644 --- a/rfc9000.md +++ b/rfc9000.md @@ -5092,8 +5092,8 @@ Packet Number Length: : The least significant two bits (those with a mask of 0x03) of byte 0 contain the length of the Packet Number field, encoded as an unsigned two-bit integer - that is one less than the length of the packet number field in bytes. That - is, the length of the packet number field is the value of this field plus one. + that is one less than the length of the Packet Number field in bytes. That + is, the length of the Packet Number field is the value of this field plus one. These bits are protected using header protection; see {{Section 5.4 of QUIC-TLS}}.