Draft: draft-ietf-quic-transport

Commentary: PR had a mistake in it , and some very confusing language . The rules for generating stateless resets was all mixed up in some complementary rules about generating packets that might trigger stateless resets . This attempts to split out the rules for generating stateless resets ( minimum size is 5 + 16 = 21 ) , and for generating packets that might trigger a stateless reset ( min_cid + 22 ) . 
 Do we need discussion on the fixed QUIC header bit in the triggering packet and outgoing reset packet ? 
 if you can lay out what you think the security concerns are in another issue , that would helpful . I realize that there are plenty of compromises in this design , which make this less than ideal . But first I 'd like to try to understand where you think this is falling short . 
 Do we need discussion on the fixed QUIC header bit in the triggering packet and outgoing reset packet ? Originally posted by in 
 Maybe I 'm misunderstanding the question , but is n't the spec is completely clear on that ? A stateless reset has the first bit unset and the second bit set . 
 Agreed , I think this is already clear and I do n't see any need to change it . 
 Thanks both . I just wanted to check and did n't feel like I had the brain cells to answer that . I do n't like relying on the image only , but the text says " two fixed bits " , and stateless reset - unlike Version Negotiation - is version - specific . So I 'm closing with no action . 
 I believe this PR addresses the stated issue , which is that the text is unclear . However , I am still concerned about the security properties of this design .
Paragraph (version A):
To entities other than its intended recipient, a stateless reset will
appear to be a packet with a short header.  For the stateless reset
to appear as a valid QUIC packet and be smaller than the received
packet, the Unpredictable Bits field needs to include at least 46
bits of data (or 6 bytes, less the two fixed bits).  To ensure the
stateless reset packet is not smaller than other packets received on
the connection, an endpoint SHOULD also ensure the total packet
length is at least the minimum chosen CID length plus 22 bytes.  22
bytes allows for 1 type byte, 4 packet number and data bytes, 16
bytes for AEAD expansion, and an extra byte to allow the peer to send
a smaller stateless reset than the packet it receives.
Paragraph (version A):
The Stateless Reset Token corresponds to the minimum expansion of the
packet protection AEAD.  More unpredictable bytes might be necessary
if the endpoint could have negotiated a packet protection scheme with
a larger minimum AEAD expansion.
Paragraph (version A):
An endpoint SHOULD NOT send a stateless reset that is significantly
larger than the packet it receives.  Endpoints MUST discard packets
that are too small to be valid QUIC packets.  With the set of AEAD
functions defined in QUIC-TLS, packets that are smaller than 21 bytes
are never valid.
Paragraph (version B):
To entities other than its intended recipient, a stateless reset will
appear to be a packet with a short header.  For the stateless reset
to appear as a valid QUIC packet, the Unpredictable Bits field needs
to include at least 38 bits of data (or 5 bytes, less the two fixed
bits).
Paragraph (version B):
A minimum size of 21 bytes does not guarantee that a stateless reset
is difficult to distinguish from other packets if the recipient
requires the use of a connection ID.  To prevent a resulting
stateless reset from being trivially distinguishable from a valid
packet, all packets sent by an endpoint SHOULD be padded to at least
22 bytes longer than the minimum connection ID that the endpoint
might use.  An endpoint that sends a stateless reset in response to
packet that is 43 bytes or less in length SHOULD send a stateless
reset that is one byte shorter than the packet it responds to.
Paragraph (version B):
These values assume that the Stateless Reset Token is the same as the
minimum expansion of the packet protection AEAD.  Additional
unpredictable bytes are necessary if the endpoint could have
negotiated a packet protection scheme with a larger minimum
expansion.
Paragraph (version B):
An endpoint MUST NOT send a stateless reset that is three times or
more larger than the packet it receives to avoid being used for
amplification.  reset-looping describes additional limits on
stateless reset size.
Paragraph (version B):
Endpoints MUST discard packets that are too small to be valid QUIC
packets.  With the set of AEAD functions defined in QUIC-TLS, packets
that are smaller than 21 bytes are never valid.
Paragraph (version A):
Finally, the last 16 bytes of the packet are set to the value of the
Stateless Reset Token.