Subject: Wrong level protection ACKs: why not an error

From: Dmitri Tikhonov <[email-masked]>
Date: Tue, 29 May 2018 15:34:28 -0400

The Draft states:

   A packet that is not protected and claims to acknowledge a packet
   number that was sent with packet protection is not valid.  An
   unprotected packet that carries acknowledgments for protected packets
   MUST be discarded in its entirety.

This seems odd.  Why is this not a connection error?  Do we expect
the peer not to be able to construct a valid ACK?

  - Dmitri.

---

From: Mikkel Fahnøe Jørgensen <[email-masked]>
Date: Tue, 29 May 2018 12:38:40 -0700

Anything in early handshake it is vulnerable to attacks.
It is better to drop ill-formed packets than allowing them to interrupt the
handshake since you can’t be sure who the sender is.

On 29 May 2018 at 21.35.01, Dmitri Tikhonov ([email-masked])
wrote:

The Draft states:

- Dmitri.

---

From: Dmitri Tikhonov <[email-masked]>
Date: Tue, 29 May 2018 15:41:25 -0400

I see.  Thank you!

  - Dmitri.