RE: Why do DATA frames have padding?

PING requires a response, which is superfluous.  There was a proposal for PADDING frames which would be discarded upon receipt, but some folks expressed concern that this imposed a minimum padding increment (the size of the frame headers).  I’m still a little dubious of the value in the distinction, personally, but I’m not a security expert.

From: Greg Wilkins [mailto:gregw@intalio.com]
Sent: Wednesday, May 7, 2014 7:46 AM
To: HTTP Working Group
Subject: Why do DATA frames have padding?


I understand the security issue of obscuring data length so that an attacker cannot send crafted data with a known compression algorithm to help search for encryption keys.
But why does the padding data created to protect against that have to be within the data frame?  This appears to a be a needless complication as the extra data can be sent either in ping frames or even in an additional stream.
Either the attacker can see frame boundaries, in which case in frame padding is no good because the attacker can see the headers - OR they can't, in which case sending some extra random length data can be done in pings and/or alternate streams and the attacker will not be the wisers.
There might be an issue with frames being sent in different packets, but that is easy for the sender to ensure simply by prepending and random size ping to any buffer used to construct a data frame.
regards
PS.  I can already imagine the abusive uses of the protocol that will start putting "hidden" meta data into the padding!


--
Greg Wilkins <gregw@intalio.com<mailto:gregw@intalio.com>>
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.