Security considerations

[gorryfair]

Would it be useful to add:

• Some advice to firewall configuration, that they should recognise greased codepoint as valid.
• Some advice to configuration of Intrusion Detection and Prevention Systems, that greasing is part of the normal protocol behaviour, not an addition on top of the core protocol.

Adding these as topics helps alert people for where to look if greasing fails.

[LPardue]

Some advice to firewall configuration, that they should recognise greased codepoint as valid.

Implementations of a protocol with extensibility that allows for ignoring unknown values benefit from greasing to exercise that behaviour.

I'm not sure what type of firewall you have in mind. Is it a "protocol implementation" or a "sniffer".

Recommending looking for greased codepoints is potentially the antithesis of what we want. It could allow a firewall to permit grease but block real, unexpected, extensions.

For example, I would expect a WAF (Web Application Firewall) to allow through headers with extension Parameters, whether they known to the WAF or not.

The QUIC grease bit is a different example at a different layer, but it's range is quite different. https://www.rfc-editor.org/rfc/rfc9287.html

Some advice to configuration of Intrusion Detection and Prevention Systems, that greasing is part of the normal protocol behaviour, not an addition on top of the core protocol.

This might already be known to some vendors. Depending on the layer, attackers might already be "randomizing" a lot of fields in order to try and elude such systems. We can probably say something about this topic in the spec.

[tfpauly]

This makes me think about the issues we've seen with adding new algorithms to TLS client hellos and triggering TLS fingerprinting boxes

[dthaler]

Would it be useful to add:

• Some advice to firewall configuration, that they should recognise greased codepoint as valid.
• Some advice to configuration of Intrusion Detection and Prevention Systems, that greasing is part of the normal protocol behaviour, not an addition on top of the core protocol.

Adding these as topics helps alert people for where to look if greasing fails.

Yes, and also some advice to protocol designers about what such IDS's typically do or want to do, to be aware of.