@@ -421,8 +421,8 @@ As an example, let's assume a client supports hypothetical QUIC versions 10, 12,
421
421
and 14 with a preference for higher versions. The client initiates a connection
422
422
attempt with version 12. Let's explore two independent example scenarios :
423
423
424
- * In the first scenario, the server supports versions 10, 13, and 14 but only
425
- 13 and 14 are Fully-Deployed. The server sends a Version Negotiation packet with
424
+ * In the first scenario, the server supports versions 10, 13, and 14 but only 13
425
+ and 14 are Fully-Deployed. The server sends a Version Negotiation packet with
426
426
versions 10, 13, and 14. This triggers an incompatible version negotiation and
427
427
the client initiates a new connection with version 14. Then the server's Other
428
428
Versions field contains 13 and 14. In that scenario, the client would have
@@ -431,12 +431,12 @@ attempt with version 12. Let's explore two independent example scenarios:
431
431
432
432
* In the second scenario, the server supports versions 10, 13, and 14 and they
433
433
are all Fully-Deployed. However, the attacker forges a Version Negotiation
434
- packet with versions 10 and 13. This triggers an incompatible version negotiation and the
435
- client initiates a new connection with version 10. Then the server's Other
436
- Versions field contains 10, 13 and 14. In that scenario, the client would have
437
- picked 14 instead of 10 if it had received a Version Negotiation packet with
438
- versions 10, 13 and 14, therefore the client aborts the handshake with a
439
- version negotiation error.
434
+ packet with versions 10 and 13. This triggers an incompatible version
435
+ negotiation and the client initiates a new connection with version 10. Then
436
+ the server's Other Versions field contains 10, 13 and 14. In that scenario,
437
+ the client would have picked 14 instead of 10 if it had received a Version
438
+ Negotiation packet with versions 10, 13 and 14, therefore the client aborts
439
+ the handshake with a version negotiation error.
440
440
441
441
This validation of Other Versions is not sufficient to prevent downgrade.
442
442
Downgrade prevention also depends on the client ignoring Version Negotiation
0 commit comments