mirror of https://github.com/ospab/ostp.git
ospab
5ab6833eab
The junk marker was a per-key CONSTANT sent in plaintext at a fixed offset in junk frames. Junk is meant to look like random noise (zapret-style), but a constant prefix is a recognizable per-user structure: an on-path observer watching one user sees the same 4 bytes on every junk packet, i.e. an OSTP fingerprint. (The earlier fix only removed the GLOBAL constant.) Now the marker rotates every 60s window: junk_marker = HKDF(key, ver, 0x04 || window). To an observer the prefix changes each window (no fixed signature), and a captured marker is only valid for ~1 window — the "bit of protection" against a leaked marker. Only a key holder can compute it, so an outsider still can't forge a silently-dropped junk packet (and silent-drop is cheaper than normal processing anyway, so junk spam was never a DoS lever to begin with). - core: derive_junk_marker(key, window) + current_junk_window() (60s window), same version-gated HKDF scheme; junk_marker dropped from DerivedSecrets. - client: stamps junk with the current window's marker. - server: checks current AND previous window per key (absorbs ~1 window of clock skew) before falling through to unauthorized-probe handling. - Not a wire break: only junk framing changes; real handshake/data untouched. During mixed rollout, unmatched junk merely logs as a probe (cosmetic). |
||
|---|---|---|
| .. | ||
| crypto | ||
| framing | ||
| congestion.rs | ||
| lib.rs | ||
| protocol.rs | ||
| relay.rs | ||
| resumption.rs | ||