W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2014

Re: h2 padding

From: Greg Wilkins <gregw@intalio.com>
Date: Thu, 4 Sep 2014 08:22:34 +1000
Message-ID: <CAH_y2NFLTRWuxJSPLoA8YiBcV1PssaAdHN+Z7eT5=Tj7P2z_-Q@mail.gmail.com>
To: Brian Smith <brian@briansmith.org>
Cc: Jason Greene <jason.greene@redhat.com>, Poul-Henning Kamp <phk@phk.freebsd.dk>, Mark Nottingham <mnot@mnot.net>, Roy Fielding <fielding@gbiv.com>, HTTP Working Group <ietf-http-wg@w3.org>
On 4 September 2014 05:33, Brian Smith <brian@briansmith.org> wrote:

> That isn't the issue. The issue is with an implementation, such as a
> proxy, that does something like "split the padding into its own frame
> and put the data in another frame," and/or putting those split frames
> in separate TLS records and/or TCP packets, which is currently allowed
> (AFAICT) in draft 14.
>

Which is precisely why telling the framing layer about security padding is
a self defeating exercise.   TCP packet boundaries are just one potential
artefact that an observer can use to guess payload sizes, handling time is
another and I'm sure somebody could even observe CPU and/or power drain if
they really wanted to get spooky about it.

If we want security padding to be truly indistinguishable from real
payload, then don't tell the framing layer that it is padding.

Better to have no security than false security.

-- 
Greg Wilkins <gregw@intalio.com>
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.
Received on Wednesday, 3 September 2014 22:23:02 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 30 March 2016 09:57:10 UTC