Subject: [quicwg/base-drafts] Field Terminology in QPACK Security Considerations (#4009)

From: Mike Bishop <[email-masked]>
Date: Mon, 17 Aug 2020 12:47:04 -0700

Noticed that the Security Considerations seems to have come in after and without the &quot;field sections&quot; terminology, so I did a pass through there.  This will probably have a few conflicts with #4007.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4009

-- Commit Summary --

  * The field police strike again

-- File Changes --

    M draft-ietf-quic-qpack.md (115)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4009.patch
https://github.com/quicwg/base-drafts/pull/4009.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 17 Aug 2020 16:32:53 -0700

@mnot approved this pull request.

LGTM

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#pullrequestreview-468897636

---

From: afrind <[email-masked]>
Date: Tue, 18 Aug 2020 15:30:16 -0700

@afrind commented on this pull request.

> @@ -1225,12 +1225,12 @@ a linear-time attack.
 ## Applicability to QPACK and HTTP
 
 QPACK mitigates but does not completely prevent attacks modeled on CRIME [CRIME]
-by forcing a guess to match an entire header field value, rather than individual
+by forcing a guess to match an entire field value, rather than individual

i think it has to match a field line, not field value (here and below)?  And technically the original HPACK text should have said entire header (you have to match the name and value).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#pullrequestreview-469870777

---

From: Lucas Pardue <[email-masked]>
Date: Tue, 18 Aug 2020 15:38:59 -0700

@LPardue commented on this pull request.

 To improve compression performance of this option, certain entries might be
 tagged as being public. For example, a web browser might make the values of the
 Accept-Encoding header field available in all requests.
 
-An encoder without good knowledge of the provenance of header fields might
-instead introduce a penalty for a header field with many different values, such
-that a large number of attempts to guess a header field value results in the
-header field not being compared to the dynamic table entries in future messages,
-effectively preventing further guesses.
+An encoder without good knowledge of the provenance of field values might
+instead introduce a penalty for a field name with many different values, such

is this correct, or a typo?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#pullrequestreview-469877584

---

From: Mike Bishop <[email-masked]>
Date: Wed, 19 Aug 2020 06:26:53 -0700

@MikeBishop commented on this pull request.

Shorthand, I think.  What it's trying to express is that if there are many field lines in the dynamic table which have the same field name and distinct values, you might with some probability ignore the dynamic table when encoding.  The more entries, the higher the probability you should ignore them all to frustrate an attacker.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#discussion_r473027526

---

From: Mike Bishop <[email-masked]>
Date: Wed, 19 Aug 2020 06:29:22 -0700

@MikeBishop pushed 1 commit.

e69cad3344323374877fd7a92d698d135ab8be64  Merge remote-tracking branch 'origin/master' into qpack/fields-again

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009/files/3a1aa02554ab85703eb067b425e5c336c5b02fec..e69cad3344323374877fd7a92d698d135ab8be64

---

From: Mike Bishop <[email-masked]>
Date: Wed, 19 Aug 2020 06:35:06 -0700

Merged #4009 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#event-3670807062

---

From: Mike Bishop <[email-masked]>
Date: Wed, 19 Aug 2020 06:38:44 -0700

Sorry, this was a mistake; I think I've backed it out now.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4009#issuecomment-676372920