Subject: Re: [quicwg/base-drafts] HPACK relies on in-order delivery (#228)

From: Mike Bishop <[email-masked]>
Date: Mon, 06 Mar 2017 12:24:55 -0800

I agree that requirement is horrific.  #274 updates the draft to say you kill the connection if you get painted into this corner.  QPACK has also been updated to remove this requirement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/228#issuecomment-284520953

---

From: Aron-Schats <[email-masked]>
Date: Mon, 06 Mar 2017 12:54:16 -0800

The introduction to RFC 7541 states that using DEFLATE to compress header fields proved "very effective."  The problem with that approach was that it made the protocol vulnerable to [CRIME](https://en.wikipedia.org/w/index.php?title=CRIME) attack.  I wonder whether QUIC would also be vulnerable to CRIME were it to use DEFLATE instead of HPACK.

The advantages of not having to come up with a specialized compression mechanism are many.  The one closest to my heart is that it would not have to be implemented.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/228#issuecomment-284528998

---

From: Martin Thomson <[email-masked]>
Date: Mon, 06 Mar 2017 15:46:22 -0800

I also note that control streams are implicitly reset by GOAWAY (CONNECTION_CLOSE too, but that's probably not going to cause any problems).  I conclude that there is a hazard inherent in committing any state to any streams that aren't created immediately after connection establishment.

@Aron-Schats, yes, QUIC would be vulnerable to those sorts of attack if it used DEFLATE.  FWIW, HPACK is also vulnerable to attack, but the researchers who studied it found it was much, much harder to extract any signal from than DEFLATE/GZIP/friends.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/228#issuecomment-284572560

---

From: krasic <[email-masked]>
Date: Thu, 23 Mar 2017 16:21:56 -0700

Was discussing REFUSED here.   Just to throw out an idea that came up which I don't remember seeing elsewhere yet.

What if the last requirement were changed to the following:

* The HTTP layer will *always* replay the *same* HPACK *frame* on a *stream 3* if a REFUSED is encountered.   

Sending again surely isn't optimal, but I think it would be quite simple to implement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/228#issuecomment-288889930