Split out of the review of #399 so it stops living as a comment in crates/offline-protocol-leaf/src/frames.rs.
What happens today
A leaf sets requires_ack = false on every frame it mints, which is right: it holds no retry queue and settles nothing against an answer, so every acknowledgement it provoked would be a frame it parses as carrying no prefix it answers, and drops. On a link with very little airtime that is one wasted transmission per frame sent.
The other direction is the gap. A phone marks its own frames as needing an acknowledgement and a leaf emits none, so the phone retries each one until its budget is exhausted. Two costs follow:
- Airtime, on exactly the link this crate exists to be careful with.
- A misleading error stream on the device. Each retransmission of a sealed frame is a replay, and the device correctly refuses it, so firmware sees a run of
LeafError::Mls that is indistinguishable from someone replaying frames at it. The one signal that would tell an integrator they are under attack is buried in traffic the protocol itself generates.
What has to be decided
The spec lists neither behaviour today. Either:
- a leaf peer is exempt from the acknowledgement machinery, and the phone learns not to ask (the capability is already carried: a leaf's key package advertises what it parses, so the phone knows what it is talking to); or
- a leaf owes an acknowledgement, and the emits list in docs/spec/leaf-provisioning.md grows one more frame, along with the flash and airtime that costs.
This is a spec question before it is a code one, which is why it is an issue rather than a patch. Related: the leaf profile's emits/accepts lists in the same chapter.
Split out of the review of #399 so it stops living as a comment in
crates/offline-protocol-leaf/src/frames.rs.What happens today
A leaf sets
requires_ack = falseon every frame it mints, which is right: it holds no retry queue and settles nothing against an answer, so every acknowledgement it provoked would be a frame it parses as carrying no prefix it answers, and drops. On a link with very little airtime that is one wasted transmission per frame sent.The other direction is the gap. A phone marks its own frames as needing an acknowledgement and a leaf emits none, so the phone retries each one until its budget is exhausted. Two costs follow:
LeafError::Mlsthat is indistinguishable from someone replaying frames at it. The one signal that would tell an integrator they are under attack is buried in traffic the protocol itself generates.What has to be decided
The spec lists neither behaviour today. Either:
This is a spec question before it is a code one, which is why it is an issue rather than a patch. Related: the leaf profile's emits/accepts lists in the same chapter.