New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Question] Stateless Reset Oracle Attack #555

Open

reteps opened this issue Jan 31, 2025 · 0 comments

reteps commented Jan 31, 2025 •

edited

Loading

Hi there, I am performing a research project to follow up some of the analysis done in "A Quic(k) Security Overview: A Literature Research on Implemented Security Recommendations"

According to their findings, the Stateless Reset Oracle defenses described in RFC 9000 21.11 has not been implemented in aiohttp.

I was hoping to:

confirm that this isn't something the library handles
check whether you would accept a PR defending against this attack

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment