Subject: [quicwg/base-drafts] secdir review of -qpack; issue 11 (#4399)

From: Lars Eggert <[email-masked]>
Date: Fri, 20 Nov 2020 01:21:40 -0800

Magnus Nystrom [wrote](https://datatracker.ietf.org/doc/review-ietf-quic-qpack-19-secdir-lc-nystrom-2020-11-19/):
>  - The security considerations section is well written, but the attack
   scenario of "mutual distrustful parties" is unclear to me. One stated
   scenario is where multiple client connections aggregate at an intermediary
   that then maintains a single connection to an origin server. Another stated
   scenario is where multiple origin servers connect to an intermediary which
   then serves a client. In these scenarios, is the concern that the
   intermediary may control either a client or an origin server and thus would
   be able to leverage the compression context at, say, a second client and
   then observe (as the intermediary) the result of a guess for a field tuple?
   It may be helpful to explain this in a little more detail.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4399

---

From: afrind <[email-masked]>
Date: Mon, 30 Nov 2020 13:25:04 -0800

This text was mostly lifted from RFC 7541.

> In these scenarios, is the concern that the

Yes, this is the concern.  It's interesting that 'intermediary' here also refers to a browser that coalesces requests from different tabs onto the same connection.

> It may be helpful to explain this in a little more detail.

I agree.

> While there are several options listed, there is also no recommendation
as to what strategy (option) implementations should choose to protect
against this attack. 

I think the document recommends the tagging option unambiguously:

"An ideal solution segregates access to the dynamic table based on the entity that is constructing the message"

While never-index literals is the less complicated fallback option.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4399#issuecomment-736065733