<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi again,<div class=""><br class=""></div><div class="">A clarification about one point here - I had overlooked “close-by”, now I think I understand the attack: this is a host on the same WiFi network, spoofing packets, and sending NACKs (or DupACKs, for TCP, probably) - right?<div class=""><br class=""></div><div class="">See below:</div><div class=""><div><br class=""><blockquote type="cite" class=""><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class=""><div class=""><div class="" style="caret-color: rgb(0, 0, 0);">Yet, the QUIC protocol makes ACKs part of the protected payload. Having the ACKs protected by the frame protection allows ensuring that nobody had meddled with the ACKs - and by this to avoid an entire class of attacks that put a close-by endpoint which NACKs segments.</div></div></div></div></div></blockquote><div class=""><br class=""></div><div class="">Were such attacks a real problem before QUIC was designed? And besides, aren’t MASQUE proxies visible and authenticated?</div></div></div></blockquote><div><br class=""></div><div>So this seems not to be a matching answer for the attack that I now think you have in mind.</div><div>Here’s another answer: this is solved by encryption between the host and the MASQUE proxy. That’s okay, I’m not questioning this part of the design. What I say is: the MASQUE proxy itself shouldn’t have to relay e2e-encrypted transport headers (which I *believe* it does, but I really still have some catching-up to do). (and of course I also don’t speak against the e2e encryption of payload!)</div><div><br class=""></div><div>Cheers,</div><div>Michael</div><div><br class=""></div></div></div></div></body></html>