Subject: Security considerations in quic-transport

From: Christian Huitema <[email-masked]>
Date: Tue, 11 Apr 2017 11:44:26 -0700

I am looking at the security considerations in the transport draft.
There is a section describing the ACK spoofing attack, which is good,
but there are quite a few other things that come to mind, which would
mimic attacks that we have seen on TCP in the past. An example:

1) Stream smurfing attack. Client (or server) opens a large number of
streams by sending stream data frames with new stream number and minimal
content.

2) Stream choke attack. Client sends request on a stream, then use
stream level flow control to choke the transmission by the server. Apply
to many parallel streams for bonus effect.

3) Silly stream number attack. Client opens stream 2*N+1 for some
outlandish version of N. Might play havoc with server management of
incoming streams.

4) Stream drop by drop attack. Client sends data on a stream extremely
slowly, maybe 1 byte at a time. Server spin its wheels waiting for data.

There are probably some more.

Should these be documented?

-- Christian Huitema

---

From: Martin Thomson <[email-masked]>
Date: Tue, 18 Apr 2017 15:29:39 +1000

> Should these be documented?

Yes.  Text would be welcome :)

I've opened an issue so that we don't forget:
https://github.com/quicwg/base-drafts/issues/440

---

From: Christian Huitema <[email-masked]>
Date: Wed, 19 Apr 2017 12:23:51 -0700

Hello Martin,

I heeded your advice and proposed some text in PR 444. But I am puzzled
by the Verifier tests in the PR log. It complains that "All checks have
failed (1 failing check)". I tried looking at the "details" output
there. The first time, I saw a complain that an input line was larger
than 80 chars. 80 chars, really, are we still using punch cards
somewhere? In any case, I fixed that, the checks still fail, and the
"detail" link won't display anything, even after waiting for an hour or
so. This seems really weird. Any idea what is happening?

-- Christian Huitema

-- 
-- Christian Huitema

---

From: Christian Huitema <[email-masked]>
Date: Wed, 19 Apr 2017 12:50:48 -0700

> so. This seems really weird. Any idea what is happening?
OK, I finally figured out that a space at the end of a line breaks the
markdown conversion. Puzzling, but, whatever...

-- Christian Huitema

---

From: Martin Thomson <[email-masked]>
Date: Thu, 20 Apr 2017 10:16:59 +1000

> markdown conversion. Puzzling, but, whatever...

There are some basic linting hacks in the build to ensure that
trailing whitespace and other formatting things don't get out of hand.
It's easier to stay on top of these things; it keeps the blame clean
for one.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 20 Apr 2017 10:50:54 +1000

On 20 April 2017 at 05:23, Christian Huitema <[email-masked]> wrote:
> I heeded your advice and proposed some text in PR 444.

Thanks for doing that Christian.  I have a few comments on your text.
I'm happy to look at making a few changes if you'd prefer, but I
thought that I'd give you the first opportunity.