From b92806d199fa233ac4ac93d1381d40572562f54c Mon Sep 17 00:00:00 2001 From: JackDoan Date: Thu, 15 Oct 2026 10:26:37 -0500 Subject: [PATCH] Record accepting per-path msg2 resends to replayed msg1s --- docs/pq-handshake.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/pq-handshake.md b/docs/pq-handshake.md index bbb0ae82..3e53bfc9 100644 --- a/docs/pq-handshake.md +++ b/docs/pq-handshake.md @@ -357,6 +357,11 @@ Implemented in `handshake/fragment` (`Sender`, `Assembly`, and the capped `Table a resend costs the initiator K packets on that path and the answer is held to the 3x budget below. That is TFTP's Sorcerer's Apprentice bound, per path rather than per handshake. + A path is only an address and port, so a recently answered msg1 replayed from spoofed + sources draws one cached msg2 to each, at about 1.2-1.4x the bytes sent and never over 3x, + for as long as the answered msg1 is remembered (the handshake timeout). Accepted + (2026-10-15): classical IX already resends its stored msg2 to any source that replays msg1, + with no clock at all, and a per-handshake clock is what broke a path that only works one way. - Duplicate msg1 detection compares the decoded message to the cached one **before** running Noise or certificate verification. - Before an address is validated, a responder sends at most 3x the bytes it received from