Subject: fyi: Analyzing and Fixing the QACCE Security of QUIC

From: =JeffH <[email-masked]>
Date: Mon, 28 Nov 2016 12:31:05 -0800

of possible interest, tho this paper seems to be more about the QACCE 
security model of QUIC than QUIC itself (YMMV)...

Analyzing and Fixing the QACCE Security of QUIC
Sakurada, Yoneyama, Hanatani, Yosihda
<https://books.google.com/books?hl=en&lr=&id=S7aVDQAAQBAJ&oi=fnd&pg=PA1&dq=Analyzing+and+Fixing+the+QACCE+security+of+QUIC>

Abstract: ... Lychev et al proposed a security model (QACCE model) to 
capture the security of QUIC. However, the QACCE model is very 
complicated, and it is not lcear if security requirements for QUIC are 
appropriately defined. In this paper, we show the first formal analysis 
result of QUIC using automated security verifiction tool ProVerif. Our 
symbolic model formalizes the QACCE model and the specification of QUIC. 
As a result of the verification, we find three attacks against QUIC in 
the QACCE model. ... we give a way to improve the QACCE model to exactly 
address the appropriate security requirements.

see also..

http://csrc.nist.gov/groups/ST/ssr2016/accepted-papers.html