{"action":"created","comment":{"url":"https://api.github.com/repos/quicwg/base-drafts/pulls/comments/320798850","pull_request_review_id":283653099,"id":320798850,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDMyMDc5ODg1MA==","diff_hunk":"@@ -5730,6 +5730,17 @@ decisions are made independently of client-selected values; a Source Connection\n ID can be selected to route later packets to the same server.\n \n \n+## Hash Collision Attack on Stateless Reset Tokens\n+\n+As the stateless reset tokens are controlled by the peers, QUIC endpoints SHOULD\n+be resistant to hash flooding DoS attacks when using a hash map for retaining\n+those tokens. One way of achieving such property is to retain and compare the\n+transformed values of the stateless tokens where the transformation is defined\n+as a pseudo-random permutation (e.g., block cipher) or a keyed hash (e.g., HMAC\n+{{?RFC2104}}) that is cryptographically secure, instead of using the raw token\n+values as the hash keys.  This approach satisfies the secure comparison","path":"draft-ietf-quic-transport.md","position":21,"original_position":21,"commit_id":"c36c242c108a417f8190febc847c6e29531270a8","original_commit_id":"c36c242c108a417f8190febc847c6e29531270a8","user":{"login":"janaiyengar","id":11067604,"node_id":"MDQ6VXNlcjExMDY3NjA0","avatar_url":"https://avatars2.githubusercontent.com/u/11067604?v=4","gravatar_id":"","url":"https://api.github.com/users/janaiyengar","html_url":"https://github.com/janaiyengar","followers_url":"https://api.github.com/users/janaiyengar/followers","following_url":"https://api.github.com/users/janaiyengar/following{/other_user}","gists_url":"https://api.github.com/users/janaiyengar/gists{/gist_id}","starred_url":"https://api.github.com/users/janaiyengar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janaiyengar/subscriptions","organizations_url":"https://api.github.com/users/janaiyengar/orgs","repos_url":"https://api.github.com/users/janaiyengar/repos","events_url":"https://api.github.com/users/janaiyengar/events{/privacy}","received_events_url":"https://api.github.com/users/janaiyengar/received_events","type":"User","site_admin":false},"body":"Suggested rephrase: \"... transformed values of the stateless tokens instead of the raw token values. A transformation such as a pseudo-random permutation (e.g. block cipher) or a cryptographically-secure keyed hash (e.g., HMAC {{?RFC2104}}) can be used to also ensure that comparing stateless tokens does not leak timing information, as specified in {{detect-stateless-reset}}.\"","created_at":"2019-09-04T14:41:18Z","updated_at":"2019-09-04T14:41:24Z","html_url":"https://github.com/quicwg/base-drafts/pull/3005#discussion_r320798850","pull_request_url":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/comments/320798850"},"html":{"href":"https://github.com/quicwg/base-drafts/pull/3005#discussion_r320798850"},"pull_request":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005"}}},"pull_request":{"url":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005","id":313832408,"node_id":"MDExOlB1bGxSZXF1ZXN0MzEzODMyNDA4","html_url":"https://github.com/quicwg/base-drafts/pull/3005","diff_url":"https://github.com/quicwg/base-drafts/pull/3005.diff","patch_url":"https://github.com/quicwg/base-drafts/pull/3005.patch","issue_url":"https://api.github.com/repos/quicwg/base-drafts/issues/3005","number":3005,"state":"open","locked":false,"title":"Add Security Considerations for SRT hash collision attack","user":{"login":"kazuho","id":41567,"node_id":"MDQ6VXNlcjQxNTY3","avatar_url":"https://avatars2.githubusercontent.com/u/41567?v=4","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"body":"Addresses the concerns discussed in #2993, #2152.\r\n\r\n**Warning: this PR builds on top of #2993.** Please let me know if you'd want me to open an issue for this and handle the PR separately rather than piggybacking on #2993.","created_at":"2019-09-04T02:29:54Z","updated_at":"2019-09-04T14:41:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b65e7adf1f773de1756ea3bdbe415af274a49044","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005/commits","review_comments_url":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005/comments","review_comment_url":"https://api.github.com/repos/quicwg/base-drafts/pulls/comments{/number}","comments_url":"https://api.github.com/repos/quicwg/base-drafts/issues/3005/comments","statuses_url":"https://api.github.com/repos/quicwg/base-drafts/statuses/c36c242c108a417f8190febc847c6e29531270a8","head":{"label":"kazuho:kazuho/security-considerations-hashdos","ref":"kazuho/security-considerations-hashdos","sha":"c36c242c108a417f8190febc847c6e29531270a8","user":{"login":"kazuho","id":41567,"node_id":"MDQ6VXNlcjQxNTY3","avatar_url":"https://avatars2.githubusercontent.com/u/41567?v=4","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"repo":{"id":128053866,"node_id":"MDEwOlJlcG9zaXRvcnkxMjgwNTM4NjY=","name":"base-drafts","full_name":"kazuho/base-drafts","private":false,"owner":{"login":"kazuho","id":41567,"node_id":"MDQ6VXNlcjQxNTY3","avatar_url":"https://avatars2.githubusercontent.com/u/41567?v=4","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"html_url":"https://github.com/kazuho/base-drafts","description":" Internet-Drafts that make up the base QUIC specification","fork":true,"url":"https://api.github.com/repos/kazuho/base-drafts","forks_url":"https://api.github.com/repos/kazuho/base-drafts/forks","keys_url":"https://api.github.com/repos/kazuho/base-drafts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kazuho/base-drafts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kazuho/base-drafts/teams","hooks_url":"https://api.github.com/repos/kazuho/base-drafts/hooks","issue_events_url":"https://api.github.com/repos/kazuho/base-drafts/issues/events{/number}","events_url":"https://api.github.com/repos/kazuho/base-drafts/events","assignees_url":"https://api.github.com/repos/kazuho/base-drafts/assignees{/user}","branches_url":"https://api.github.com/repos/kazuho/base-drafts/branches{/branch}","tags_url":"https://api.github.com/repos/kazuho/base-drafts/tags","blobs_url":"https://api.github.com/repos/kazuho/base-drafts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kazuho/base-drafts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kazuho/base-drafts/git/refs{/sha}","trees_url":"https://api.github.com/repos/kazuho/base-drafts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kazuho/base-drafts/statuses/{sha}","languages_url":"https://api.github.com/repos/kazuho/base-drafts/languages","stargazers_url":"https://api.github.com/repos/kazuho/base-drafts/stargazers","contributors_url":"https://api.github.com/repos/kazuho/base-drafts/contributors","subscribers_url":"https://api.github.com/repos/kazuho/base-drafts/subscribers","subscription_url":"https://api.github.com/repos/kazuho/base-drafts/subscription","commits_url":"https://api.github.com/repos/kazuho/base-drafts/commits{/sha}","git_commits_url":"https://api.github.com/repos/kazuho/base-drafts/git/commits{/sha}","comments_url":"https://api.github.com/repos/kazuho/base-drafts/comments{/number}","issue_comment_url":"https://api.github.com/repos/kazuho/base-drafts/issues/comments{/number}","contents_url":"https://api.github.com/repos/kazuho/base-drafts/contents/{+path}","compare_url":"https://api.github.com/repos/kazuho/base-drafts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kazuho/base-drafts/merges","archive_url":"https://api.github.com/repos/kazuho/base-drafts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kazuho/base-drafts/downloads","issues_url":"https://api.github.com/repos/kazuho/base-drafts/issues{/number}","pulls_url":"https://api.github.com/repos/kazuho/base-drafts/pulls{/number}","milestones_url":"https://api.github.com/repos/kazuho/base-drafts/milestones{/number}","notifications_url":"https://api.github.com/repos/kazuho/base-drafts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kazuho/base-drafts/labels{/name}","releases_url":"https://api.github.com/repos/kazuho/base-drafts/releases{/id}","deployments_url":"https://api.github.com/repos/kazuho/base-drafts/deployments","created_at":"2018-04-04T11:40:34Z","updated_at":"2019-07-10T05:05:31Z","pushed_at":"2019-09-04T04:52:23Z","git_url":"git://github.com/kazuho/base-drafts.git","ssh_url":"git@github.com:kazuho/base-drafts.git","clone_url":"https://github.com/kazuho/base-drafts.git","svn_url":"https://github.com/kazuho/base-drafts","homepage":"https://quicwg.github.io/","size":56377,"stargazers_count":0,"watchers_count":0,"language":"Shell","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":1,"license":null,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"quicwg:ct-sr","ref":"ct-sr","sha":"9e7142b9989bad34fdd86cc9c7dec57abfe514ea","user":{"login":"quicwg","id":22631371,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjMxMzcx","avatar_url":"https://avatars3.githubusercontent.com/u/22631371?v=4","gravatar_id":"","url":"https://api.github.com/users/quicwg","html_url":"https://github.com/quicwg","followers_url":"https://api.github.com/users/quicwg/followers","following_url":"https://api.github.com/users/quicwg/following{/other_user}","gists_url":"https://api.github.com/users/quicwg/gists{/gist_id}","starred_url":"https://api.github.com/users/quicwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quicwg/subscriptions","organizations_url":"https://api.github.com/users/quicwg/orgs","repos_url":"https://api.github.com/users/quicwg/repos","events_url":"https://api.github.com/users/quicwg/events{/privacy}","received_events_url":"https://api.github.com/users/quicwg/received_events","type":"Organization","site_admin":false},"repo":{"id":73779599,"node_id":"MDEwOlJlcG9zaXRvcnk3Mzc3OTU5OQ==","name":"base-drafts","full_name":"quicwg/base-drafts","private":false,"owner":{"login":"quicwg","id":22631371,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjMxMzcx","avatar_url":"https://avatars3.githubusercontent.com/u/22631371?v=4","gravatar_id":"","url":"https://api.github.com/users/quicwg","html_url":"https://github.com/quicwg","followers_url":"https://api.github.com/users/quicwg/followers","following_url":"https://api.github.com/users/quicwg/following{/other_user}","gists_url":"https://api.github.com/users/quicwg/gists{/gist_id}","starred_url":"https://api.github.com/users/quicwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quicwg/subscriptions","organizations_url":"https://api.github.com/users/quicwg/orgs","repos_url":"https://api.github.com/users/quicwg/repos","events_url":"https://api.github.com/users/quicwg/events{/privacy}","received_events_url":"https://api.github.com/users/quicwg/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/quicwg/base-drafts","description":" Internet-Drafts that make up the base QUIC specification","fork":false,"url":"https://api.github.com/repos/quicwg/base-drafts","forks_url":"https://api.github.com/repos/quicwg/base-drafts/forks","keys_url":"https://api.github.com/repos/quicwg/base-drafts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/quicwg/base-drafts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/quicwg/base-drafts/teams","hooks_url":"https://api.github.com/repos/quicwg/base-drafts/hooks","issue_events_url":"https://api.github.com/repos/quicwg/base-drafts/issues/events{/number}","events_url":"https://api.github.com/repos/quicwg/base-drafts/events","assignees_url":"https://api.github.com/repos/quicwg/base-drafts/assignees{/user}","branches_url":"https://api.github.com/repos/quicwg/base-drafts/branches{/branch}","tags_url":"https://api.github.com/repos/quicwg/base-drafts/tags","blobs_url":"https://api.github.com/repos/quicwg/base-drafts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/quicwg/base-drafts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/quicwg/base-drafts/git/refs{/sha}","trees_url":"https://api.github.com/repos/quicwg/base-drafts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/quicwg/base-drafts/statuses/{sha}","languages_url":"https://api.github.com/repos/quicwg/base-drafts/languages","stargazers_url":"https://api.github.com/repos/quicwg/base-drafts/stargazers","contributors_url":"https://api.github.com/repos/quicwg/base-drafts/contributors","subscribers_url":"https://api.github.com/repos/quicwg/base-drafts/subscribers","subscription_url":"https://api.github.com/repos/quicwg/base-drafts/subscription","commits_url":"https://api.github.com/repos/quicwg/base-drafts/commits{/sha}","git_commits_url":"https://api.github.com/repos/quicwg/base-drafts/git/commits{/sha}","comments_url":"https://api.github.com/repos/quicwg/base-drafts/comments{/number}","issue_comment_url":"https://api.github.com/repos/quicwg/base-drafts/issues/comments{/number}","contents_url":"https://api.github.com/repos/quicwg/base-drafts/contents/{+path}","compare_url":"https://api.github.com/repos/quicwg/base-drafts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/quicwg/base-drafts/merges","archive_url":"https://api.github.com/repos/quicwg/base-drafts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/quicwg/base-drafts/downloads","issues_url":"https://api.github.com/repos/quicwg/base-drafts/issues{/number}","pulls_url":"https://api.github.com/repos/quicwg/base-drafts/pulls{/number}","milestones_url":"https://api.github.com/repos/quicwg/base-drafts/milestones{/number}","notifications_url":"https://api.github.com/repos/quicwg/base-drafts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/quicwg/base-drafts/labels{/name}","releases_url":"https://api.github.com/repos/quicwg/base-drafts/releases{/id}","deployments_url":"https://api.github.com/repos/quicwg/base-drafts/deployments","created_at":"2016-11-15T05:30:30Z","updated_at":"2019-09-04T08:40:52Z","pushed_at":"2019-09-04T08:44:11Z","git_url":"git://github.com/quicwg/base-drafts.git","ssh_url":"git@github.com:quicwg/base-drafts.git","clone_url":"https://github.com/quicwg/base-drafts.git","svn_url":"https://github.com/quicwg/base-drafts","homepage":"https://quicwg.github.io/","size":157418,"stargazers_count":780,"watchers_count":780,"language":"Shell","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":120,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":122,"license":null,"forks":120,"open_issues":122,"watchers":780,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005"},"html":{"href":"https://github.com/quicwg/base-drafts/pull/3005"},"issue":{"href":"https://api.github.com/repos/quicwg/base-drafts/issues/3005"},"comments":{"href":"https://api.github.com/repos/quicwg/base-drafts/issues/3005/comments"},"review_comments":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005/comments"},"review_comment":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/quicwg/base-drafts/pulls/3005/commits"},"statuses":{"href":"https://api.github.com/repos/quicwg/base-drafts/statuses/c36c242c108a417f8190febc847c6e29531270a8"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"janaiyengar"}}