QUIC Version 2
draft-ietf-quic-v2-10

[Ballot comment]
Thanks for a clear document.

My only minor concern is that some hardcoded values are introduced without explaining how these were generated. I would have preferred some ascii string hashed using a KDF.

[Ballot comment]
Quoting Rob Wilton:
"Thank you.  Another well written, easy to read, draft from the QUIC WG." - Thank you for this, and also thanks to Bo Wu for the OpsDir review.

I'd note that the start of the Abstract ("This document specifies QUIC version 2, which is identical to QUIC version 1 except for some trivial details.") made me schnort, and got me some odd looks from seat-mate on a plane...


A few (very much non-blocking) comments:
Section 3.  Differences with QUIC Version 1
"QUIC version 2 endpoints MUST implement the QUIC version 1 specification as described in [QUIC], [QUIC-TLS], and [QUIC-RECOVERY].  However, the following differences apply in version 2."
This feels like a fragment / truncated paragraph - perhaps there is a better way to word this (like "The remainder of this section lists the differences", or perhaps just changing the final period to a colon would help.


Section 3.1:
"The Version field of long headers is 0x709a50c4." and "initial_salt = 0xa707.... ", "secret = 0x3425c20cf..."  -- it seems like it would be friendly to the reader to point at how this was derived (otherwise someone is going to assume something like that there have already been 1889161411 prior versions :-)). "It's to prevent ossification / grease" describes *why*, but not *how*.
I'd thought I'd seen some useful text in some other draft/document that could be stolen, but perhaps it was just in a presentation... Especially when there are things like salts and magic security parameters, providing some sort of explanation helps avoid the "that was chosen by TLA to make  easier" conspiracy...

[Ballot comment]
# GEN AD review of draft-ietf-quic-v2-06

CC @larseggert

Thanks to Joel Halpern for the General Area Review Team (Gen-ART) review
(https://mailarchive.ietf.org/arch/msg/gen-art/FongVrUNe4XJy0AYoz8ptcl2ZVs).

## Nits

All comments below are about very minor potential issues that you may choose to
address in some way - or ignore - as you see fit. Some were flagged by
automated tools (via https://github.com/larseggert/ietf-reviewtool), so there
will likely be some false positives. There is no need to let me know what you
did with these suggestions.

### Grammar/style

#### Section 1, paragraph 2
```
ey derivation and packet formats. Finally [QUIC-VN] provides two mechanisms
                                  ^^^^^^^
```
A comma may be missing after the conjunctive/linking adverb "Finally".

## Notes

This review is in the ["IETF Comments" Markdown format][ICMF], You can use the
[`ietf-comments` tool][ICT] to automatically convert this review into
individual GitHub issues. Review generated by the [`ietf-reviewtool`][IRT].

[ICMF]: https://github.com/mnot/ietf-comments/blob/main/format.md
[ICT]: https://github.com/mnot/ietf-comments
[IRT]: https://github.com/larseggert/ietf-reviewtool

[Ballot comment]
# Internet AD comments for draft-ietf-quic-v2-06
CC @ekline

## Nits

### S3.3.2

* Hopefully the RFC Editor can help adjust things to make sure that these
  key strings don't get line-split on internal whitespace, vis.:

  "quic
  hp"

  versus "quic hp"

[Ballot comment]

# Éric Vyncke, INT AD, comments for draft-ietf-quic-v2-06
CC @evyncke

Thank you for the work put into this document.

Please find below some non-blocking COMMENT points (but replies would be appreciated even if only for my own education).

Special thanks to Matt Joras for the shepherd's detailed write-up including the WG consensus *even* if the justification of the intended status is rather weak.

Please note that Vladimír Čunát is the DNS directorate reviewer (at the chairs' request) and you may want to consider his review as well:
https://datatracker.ietf.org/doc/review-ietf-quic-v2-05-dnsdir-lc-cunat-2022-10-12/

I hope that this review helps to improve the document,

Regards,

-éric

## COMMENTS

### Section 3.1

Just curious: why not used 0x0000002 as the version number... For curious readers (including some ADs), some explanations will be welcome.

### Section 6

While I still wonder about the justification of this document (i.e., is it based on some measurements of some middleboxes ?), I dislike ossification, hence supporting this document.

*BUT*, if an ossified firewall forces the negotiation to use version 1, then how would this ossification be known outside of the client ? Will there be a back channel from the client to do some instrumentation ?

### Section 9

RFC 8126 section 3.1 recommends to specify the URL of the modified registry, i.e., https://www.iana.org/assignments/quic/quic.xhtml#quic-versions .

## Notes

This review is in the ["IETF Comments" Markdown format][ICMF], You can use the
[`ietf-comments` tool][ICT] to automatically convert this review into
individual GitHub issues.

[ICMF]: https://github.com/mnot/ietf-comments/blob/main/format.md
[ICT]: https://github.com/mnot/ietf-comments

[Ballot comment]
From §4:

  For example, an origin advertising support for "h3" in Alt-Svc
  SHOULD support QUIC version 1 as it was the original QUIC version
  used by HTTP/3 and therefore some clients will only support that
  version.


If an example, normative language shouldn't be used.  s/SHOULD/should

[Ballot comment]
Thank you to Kyle Rose for the SECDIR review.

** Section 3.3.2.  In the spirit of this document being an example of the “the minimum set of changes necessary to specify a new QUIC version”, is the naming convention of the HKDF labels here what should be used in the future?  Specifically “quicv {version number} key”, “quicv{version number} iv”, etc.

** Section 5.
(a) Clients SHOULD NOT use
  a session ticket or token from a QUIC version 1 connection to
  initiate a QUIC version 2 connection, or vice versa.

(b) Servers MUST validate the originating version of any session ticket
  or token and not accept one issued from a different version.

My reading of this text is that (a) is specifying the client behavior and (b) is the server behavior.  (a) appears to be more flexible and allowing for the possibility of mixing version numbers between session tickets (i.e. it says SHOULD NOT, not MUST NOT), but (b) is then instructed to reject this flexibility. Why doesn’t (a) just say MUST NOT?

** Section 6.

  Clients interested in combating firewall ossification  can initiate a
  connection using version 2 if they are either reasonably certain the
  server supports it, or are willing to suffer a round-trip penalty if
  they are incorrect. 

Consider s/firewall/middle-box/ to generalize the applicability.

** Section 8.  Observing support for different version of QUIC, especially in early days of deployment, could be another data point in fingerprinting end-point devices.

[Ballot comment]
Hi,

Thank you.  Another well written, easy to read, draft from the QUIC WG.

Minor level comments:                                                                                                                                                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                                                                                                                           
(1) p 2, sec 1.  Introduction                                                                                                                                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                                                                                                                                                           
  QUIC version 2 is meant to mitigate ossification concerns and
  exercise the version negotiation mechanisms.  The changes provide an
  example of the minimum set of changes necessary to specify a new QUIC
  version.

As a minor comment, I would suggest adding some text to the first sentence to cite that choosing a value other than 2 for the version number, and changing the type field assignment of the long header packet format, are examples of mitigating ossification concerns.  Specifically, I presume it isn't the case that all new QUIC versions need to renumber the type fields or choose a fixed random number for the version number?  I.e., strictly speaking I assume that these are not the minimal set of changes for any new QUIC version?

Regards,
Rob

// Thanks to Bo for the OPS DIR review.

(Via drafts-lastcall-comment@iana.org): IESG/Authors/WG Chairs:

The IANA Functions Operator has completed its review of draft-ietf-quic-v2-05. If any part of this review is inaccurate, please let us know.

The IANA Functions Operator understands that, upon approval of this document, there is a single action which we must complete.

In the QUIC Versions registry on the QUIC registry page located at:

https://www.iana.org/assignments/quic/

a single, new registration will be made as follows:

Value: 0x709a50c4
Status: provisional
Specification: [ RFC-to-be ]
Date: [ TBD-at-registration ]
Change Controller: IETF
Contact: [QUIC_WG]
Notes:

Because this registry requires Expert Review [RFC8126] for registration, we've contacted the IESG-designated expert in a separate ticket to request approval. Expert review should be completed before your document can be approved for publication as an RFC.

The IANA Functions Operator understands that this is the only action required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

For definitions of IANA review states, please see:

https://datatracker.ietf.org/help/state/draft/iana-review

Thank you,

David Dong
IANA Services Specialist

The following Last Call announcement was sent out (ends 2022-10-11):

From: The IESG
To: IETF-Announce
CC: Zaheduzzaman.Sarker@ericsson.com, draft-ietf-quic-v2@ietf.org, matt.joras@gmail.com, quic-chairs@ietf.org, quic@ietf.org
Reply-To: last-call@ietf.org
Sender:
Subject: Last Call:  (QUIC Version 2) to Proposed Standard


The IESG has received a request from the QUIC WG (quic) to consider the
following document: - 'QUIC Version 2'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-call@ietf.org mailing lists by 2022-10-11. Exceptionally, comments may
be sent to iesg@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


  This document specifies QUIC version 2, which is identical to QUIC
  version 1 except for some trivial details.  Its purpose is to combat
  various ossification vectors and exercise the version negotiation
  framework.  It also serves as a template for the minimum changes in
  any future version of QUIC.

  Note that "version 2" is an informal name for this proposal that
  indicates it is the second standards-track QUIC version.  The
  protocol specified here uses a version number other than 2 in the
  wire image.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-quic-v2/



No IPR declarations have been submitted directly on this I-D.

Thank you for your service as a document shepherd. Among the responsibilities is
answering the questions in this write-up to give helpful context to Last Call
and Internet Engineering Steering Group ([IESG][1]) reviewers, and your
diligence in completing it is appreciated. The full role of the shepherd is
further described in [RFC 4858][2]. You will need the cooperation of the authors
and editors to complete these checks.

Note that some numbered items contain multiple related questions; please be sure
to answer all of them.

## Document History

1. Does the working group (WG) consensus represent the strong concurrence of a
  few individuals, with others being silent, or did it reach broad agreement?

Broad agreement. This document was widely discussed on github, the mailing list, and at multiple IETF meetings.

2. Was there controversy about particular points, or were there decisions where
  the consensus was particularly rough?

Given the nature of the work (versions) and the relationship with version negotiation, there were some philosophical questions that had to be ironed out, but ultimately the consensus was not unusually rough.

3. Has anyone threatened an appeal or otherwise indicated extreme discontent? If
  so, please summarize the areas of conflict in separate email messages to the
  responsible Area Director. (It should be in a separate email because this
  questionnaire is publicly available.)

No.

4. For protocol documents, are there existing implementations of the contents of
  the document? Have a significant number of potential implementers indicated
  plans to implement? Are any existing implementations reported somewhere,
  either in the document itself (as [RFC 7942][3] recommends) or elsewhere
  (where)?

There are multiple interoperating implementations which have been reported and tested through the typical form of social testing on the QUIC dev slack workspace. This includes major implementers who intend to use it in production.

### Additional Reviews

5. Do the contents of this document closely interact with technologies in other
  IETF working groups or external organizations, and would it therefore benefit
  from their review? Have those reviews occurred? If yes, describe which
  reviews took place.

No.

6. Describe how the document meets any required formal expert review criteria,
  such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

None.

7. If the document contains a YANG module, has the final version of the module
  been checked with any of the [recommended validation tools][4] for syntax and
  formatting validation? If there are any resulting errors or warnings, what is
  the justification for not fixing them at this time? Does the YANG module
  comply with the Network Management Datastore Architecture (NMDA) as specified
  in [RFC 8342][5]?

N/A

8. Describe reviews and automated checks performed to validate sections of the
  final version of the document written in a formal language, such as XML code,
  BNF rules, MIB definitions, CBOR's CDDL, etc.

Normal linting.

### Document Shepherd Checks

9. Based on the shepherd's review of the document, is it their opinion that this
  document is needed, clearly written, complete, correctly designed, and ready
  to be handed off to the responsible Area Director?

I believe these documents are clearly written, complete, correctly designed, and ready for AD review.

10. Several IETF Areas have assembled [lists of common issues that their
    reviewers encounter][6]. For which areas have such issues been identified and addressed?
    For which does this still need to happen in subsequent reviews?

N/A.

11. What type of RFC publication is being requested on the IETF stream ([Best
    Current Practice][12], [Proposed Standard, Internet Standard][13],
    [Informational, Experimental or Historic][14])? Why is this the proper type
    of RFC? Do all Datatracker state attributes correctly reflect this intent?

Proposed Standard; because we believe there is consensus to publish it

12. Have reasonable efforts been made to remind all authors of the intellectual
    property rights (IPR) disclosure obligations described in [BCP 79][8]?
    To the best of your knowledge, have all required disclosures been filed?
    If not, explain why. If yes, summarize any relevant discussion, including
    links to publicly-available messages when applicable.

Yes, there are no disclosures to file.

13. Has each author, editor, and contributor shown their willingness to be listed
    as such? If the total number of authors and editors on the front page is
    greater than five, please provide a justification.

Yes.

14. Document any remaining I-D nits in this document. Simply running the [idnits
    tool][8] is not enough; please review the ["Content Guidelines" on
    authors.ietf.org][15]. (Also note that the current idnits tool generates
    some incorrect warnings; a rewrite is underway.)

None.

15. Should any informative references be normative or vice-versa? See the [IESG
    Statement on Normative and Informative References][16].

Not that I can see.

16. List any normative references that are not freely available to anyone. Did
    the community have sufficient access to review any such normative
    references?

None.

17. Are there any normative downward references (see [RFC 3967][9] and
    [BCP 97][10]) that are not already listed in the [DOWNREF registry][17]?
    If so, list them.

None.

18. Are there normative references to documents that are not ready to be
    submitted to the IESG for publication or are otherwise in an unclear state?
    If so, what is the plan for their completion?

None.

19. Will publication of this document change the status of any existing RFCs? If
    so, does the Datatracker metadata correctly reflect this and are those RFCs
    listed on the title page, in the abstract, and discussed in the
    introduction? If not, explain why and point to the part of the document
    where the relationship of this document to these other RFCs is discussed.

No.

20. Describe the document shepherd's review of the IANA considerations section,
    especially with regard to its consistency with the body of the document.
    Confirm that all aspects of the document requiring IANA assignments are
    associated with the appropriate reservations in IANA registries. Confirm
    that any referenced IANA registries have been clearly identified. Confirm
    that each newly created IANA registry specifies its initial contents,
    allocations procedures, and a reasonable name (see [RFC 8126][11]).

The document clearly identifies the registration of new a value in the QUIC
versions registry. While developed in the WG, the document has used values in
the provisional range. Once the document is approved, a value in the permanent
range will be requested for allocation. This document, as a Proposed Standard,
meets the permanent registration criteria.


21. List any new IANA registries that require Designated Expert Review for
    future allocations. Are the instructions to the Designated Expert clear?
    Please include suggestions of designated experts, if appropriate.
N/A

Thank you for your service as a document shepherd. Among the responsibilities is
answering the questions in this write-up to give helpful context to Last Call
and Internet Engineering Steering Group ([IESG][1]) reviewers, and your
diligence in completing it is appreciated. The full role of the shepherd is
further described in [RFC 4858][2]. You will need the cooperation of the authors
and editors to complete these checks.

Note that some numbered items contain multiple related questions; please be sure
to answer all of them.

## Document History

1. Does the working group (WG) consensus represent the strong concurrence of a
  few individuals, with others being silent, or did it reach broad agreement?

Broad agreement. This document was widely discussed on github, the mailing list, and at multiple IETF meetings.

2. Was there controversy about particular points, or were there decisions where
  the consensus was particularly rough?

Given the nature of the work (versions) and the relationship with version negotiation, there were some philosophical questions that had to be ironed out, but ultimately the consensus was not unusually rough.

3. Has anyone threatened an appeal or otherwise indicated extreme discontent? If
  so, please summarize the areas of conflict in separate email messages to the
  responsible Area Director. (It should be in a separate email because this
  questionnaire is publicly available.)

No.

4. For protocol documents, are there existing implementations of the contents of
  the document? Have a significant number of potential implementers indicated
  plans to implement? Are any existing implementations reported somewhere,
  either in the document itself (as [RFC 7942][3] recommends) or elsewhere
  (where)?

There are multiple interoperating implementations which have been reported and tested through the typical form of social testing on the QUIC dev slack workspace. This includes major implementers who intend to use it in production.

### Additional Reviews

5. Do the contents of this document closely interact with technologies in other
  IETF working groups or external organizations, and would it therefore benefit
  from their review? Have those reviews occurred? If yes, describe which
  reviews took place.

No.

6. Describe how the document meets any required formal expert review criteria,
  such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

None.

7. If the document contains a YANG module, has the final version of the module
  been checked with any of the [recommended validation tools][4] for syntax and
  formatting validation? If there are any resulting errors or warnings, what is
  the justification for not fixing them at this time? Does the YANG module
  comply with the Network Management Datastore Architecture (NMDA) as specified
  in [RFC 8342][5]?

N/A

8. Describe reviews and automated checks performed to validate sections of the
  final version of the document written in a formal language, such as XML code,
  BNF rules, MIB definitions, CBOR's CDDL, etc.

Normal linting.

### Document Shepherd Checks

9. Based on the shepherd's review of the document, is it their opinion that this
  document is needed, clearly written, complete, correctly designed, and ready
  to be handed off to the responsible Area Director?

I believe these documents are clearly written, complete, correctly designed, and ready for AD review.

10. Several IETF Areas have assembled [lists of common issues that their
    reviewers encounter][6]. For which areas have such issues been identified and addressed?
    For which does this still need to happen in subsequent reviews?

N/A.

11. What type of RFC publication is being requested on the IETF stream ([Best
    Current Practice][12], [Proposed Standard, Internet Standard][13],
    [Informational, Experimental or Historic][14])? Why is this the proper type
    of RFC? Do all Datatracker state attributes correctly reflect this intent?

Proposed Standard; because we believe there is consensus to publish it

12. Have reasonable efforts been made to remind all authors of the intellectual
    property rights (IPR) disclosure obligations described in [BCP 79][8]?
    To the best of your knowledge, have all required disclosures been filed?
    If not, explain why. If yes, summarize any relevant discussion, including
    links to publicly-available messages when applicable.

Yes, there are no disclosures to file.

13. Has each author, editor, and contributor shown their willingness to be listed
    as such? If the total number of authors and editors on the front page is
    greater than five, please provide a justification.

Yes.

14. Document any remaining I-D nits in this document. Simply running the [idnits
    tool][8] is not enough; please review the ["Content Guidelines" on
    authors.ietf.org][15]. (Also note that the current idnits tool generates
    some incorrect warnings; a rewrite is underway.)

None.

15. Should any informative references be normative or vice-versa? See the [IESG
    Statement on Normative and Informative References][16].

Not that I can see.

16. List any normative references that are not freely available to anyone. Did
    the community have sufficient access to review any such normative
    references?

None.

17. Are there any normative downward references (see [RFC 3967][9] and
    [BCP 97][10]) that are not already listed in the [DOWNREF registry][17]?
    If so, list them.

None.

18. Are there normative references to documents that are not ready to be
    submitted to the IESG for publication or are otherwise in an unclear state?
    If so, what is the plan for their completion?

None.

19. Will publication of this document change the status of any existing RFCs? If
    so, does the Datatracker metadata correctly reflect this and are those RFCs
    listed on the title page, in the abstract, and discussed in the
    introduction? If not, explain why and point to the part of the document
    where the relationship of this document to these other RFCs is discussed.

No.

20. Describe the document shepherd's review of the IANA considerations section,
    especially with regard to its consistency with the body of the document.
    Confirm that all aspects of the document requiring IANA assignments are
    associated with the appropriate reservations in IANA registries. Confirm
    that any referenced IANA registries have been clearly identified. Confirm
    that each newly created IANA registry specifies its initial contents,
    allocations procedures, and a reasonable name (see [RFC 8126][11]).

The document clearly identifies the registration of new a value in the QUIC
versions registry. While developed in the WG, the document has used values in
the provisional range. Once the document is approved, a value in the permanent
range will be requested for allocation. This document, as a Proposed Standard,
meets the permanent registration criteria.


21. List any new IANA registries that require Designated Expert Review for
    future allocations. Are the instructions to the Designated Expert clear?
    Please include suggestions of designated experts, if appropriate.
N/A