Subject: [quicwg/base-drafts] Talk about padding-by-reserved-streams a little more (#4233)

From: Mike Bishop <[email-masked]>
Date: Fri, 16 Oct 2020 08:49:09 -0700

Fixes #4221.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4233

-- Commit Summary --

  * Talk about padding a little more

-- File Changes --

    M draft-ietf-quic-http.md (25)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4233.patch
https://github.com/quicwg/base-drafts/pull/4233.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233

---

From: Lucas Pardue <[email-masked]>
Date: Fri, 16 Oct 2020 10:32:50 -0700

@LPardue approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#pullrequestreview-510670668

---

From: ianswett <[email-masked]>
Date: Fri, 16 Oct 2020 11:38:09 -0700

@ianswett approved this pull request.

> @@ -1916,19 +1916,28 @@ in {{frame-reserved}} and {{stream-grease}}.  These methods of padding produce
 different results in terms of the granularity of padding, how padding is
 arranged in relation to the information that is being protected, whether padding
 is applied in the case of packet loss, and how an implementation might control
-padding.  Redundant padding could even be counterproductive.
+padding.
+
+Reserved stream types can be used to give the appearance of sending traffic even
+when the connection is idle.  Because HTTP traffic often occurs in bursts,
+apparent traffic can be used to obscure the timing or duration of such bursts,
+even to the point of appearing to send a constant stream of data.  However, as
+such traffic is still flow controlled by the receiver, a failure to promptly
+drain such streams and provide additional flow control credit can limit the
+sender's ability to send real traffic.
 
 To mitigate attacks that rely on compression, disabling or limiting compression
 might be preferable to padding as a countermeasure.
 
 Use of padding can result in less protection than might seem immediately

This section starts talking about using H2 PADDING to make a connection more resistant to traffic analysis and ends discussing how padding doesn't really help that much.  Is there a use of PADDING that is recommended?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#pullrequestreview-510715204

---

From: Mike Bishop <[email-masked]>
Date: Fri, 16 Oct 2020 12:47:14 -0700

@MikeBishop commented on this pull request.

 

I would frame it that padding is a tool that can be used to mitigate certain attacks, but it's not a perfect tool.  It's useful for its job, but you need to understand its drawbacks when designing a padding scheme.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#discussion_r506688249

---

From: ianswett <[email-masked]>
Date: Fri, 16 Oct 2020 12:48:39 -0700

@ianswett commented on this pull request.

 

Makes sense, thanks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#discussion_r506688851

---

From: Martin Thomson <[email-masked]>
Date: Sun, 18 Oct 2020 16:34:12 -0700

@martinthomson approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#pullrequestreview-511279516

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 19 Oct 2020 11:36:37 -0700

@janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#pullrequestreview-512053201

---

From: Mike Bishop <[email-masked]>
Date: Tue, 20 Oct 2020 07:25:33 -0700

Merged #4233 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4233#event-3899041830