Re: [Gen-art] Gen-ART and OPS-Dir review of draft-ietf-httpbis-header-compression-10

"Black, David" <david.black@emc.com> Fri, 23 January 2015 16:52 UTC

Return-Path: <david.black@emc.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CA091A87AC; Fri, 23 Jan 2015 08:52:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.011
X-Spam-Level:
X-Spam-Status: No, score=-4.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vmk6OX-sBV-T; Fri, 23 Jan 2015 08:52:01 -0800 (PST)
Received: from mailuogwdur.emc.com (mailuogwdur.emc.com [128.221.224.79]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF2FD1A9121; Fri, 23 Jan 2015 08:52:00 -0800 (PST)
Received: from maildlpprd56.lss.emc.com (maildlpprd56.lss.emc.com [10.106.48.160]) by mailuogwprd52.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id t0NGpeaS018584 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 23 Jan 2015 11:51:45 -0500
X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com t0NGpeaS018584
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1422031906; bh=C24nghzXxVx3KmyPoQUos/QxKuU=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=JBEmPz8ioB8s9Hhxz17iSLkBBHZlckLDkvy3voMhkZXYwsQe+zyPPPypVuZuKqyUR PlUfRpOHTYu7Qy0EYMQVvxRwJD1WKCPtLKD8lyr/D+9KLcx0MxuLjhXiaU0gn95UC5 ddVwJ6Gr4UEmvHbo7725zPaGGBcD1F7ZGe/TCgg0=
X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com t0NGpeaS018584
Received: from mailusrhubprd51.lss.emc.com (mailusrhubprd51.lss.emc.com [10.106.48.24]) by maildlpprd56.lss.emc.com (RSA Interceptor); Fri, 23 Jan 2015 11:49:37 -0500
Received: from mxhub06.corp.emc.com (mxhub06.corp.emc.com [128.222.70.203]) by mailusrhubprd51.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id t0NGpRcV020194 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 23 Jan 2015 11:51:27 -0500
Received: from MXHUB205.corp.emc.com (10.253.68.31) by mxhub06.corp.emc.com (128.222.70.203) with Microsoft SMTP Server (TLS) id 8.3.327.1; Fri, 23 Jan 2015 11:51:27 -0500
Received: from MX104CL02.corp.emc.com ([169.254.8.208]) by MXHUB205.corp.emc.com ([10.253.68.31]) with mapi id 14.03.0195.001; Fri, 23 Jan 2015 11:51:26 -0500
From: "Black, David" <david.black@emc.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Jari Arkko <jari.arkko@piuha.net>, =?utf-8?B?SGVydsOpIFJ1ZWxsYW4=?= <herve.ruellan@crf.canon.fr>
Thread-Topic: [Gen-art] Gen-ART and OPS-Dir review of draft-ietf-httpbis-header-compression-10
Thread-Index: AdAu1mrrhPGv6xDFSDefkyOsNh6OXQF3akyAABXj4QAACmrY4ABMqskAAAujVwAAC0CLgAAGGcoAABVEvIAABmwMAAAAWr+AAABYEQAACFBZcA==
Date: Fri, 23 Jan 2015 16:51:25 +0000
Message-ID: <CE03DB3D7B45C245BCA0D24327794936310012@MX104CL02.corp.emc.com>
References: <CE03DB3D7B45C245BCA0D243277949362DE459@MX104CL02.corp.emc.com> <CABkgnnUwNQUcFg5w5HFpSQrAUxtbqG_UN-_WDGop1eqqoCS+Aw@mail.gmail.com> <1421779730757.42642@crf.canon.fr> <CE03DB3D7B45C245BCA0D243277949362E9050@MX104CL02.corp.emc.com> <B42673AB-2819-42F5-BC63-6418449FC030@piuha.net> <54C13996.2030906@crf.canon.fr> <0A78F531-9E8E-4ED1-BD8F-AAE70684DB24@piuha.net> <CABkgnnVBCK-yy9WitKCVqitcXssOHgBc2c+3UeRO09mAHa3A8Q@mail.gmail.com> <54C23CC5.7050901@cs.tcd.ie> <54C267DE.5040202@crf.canon.fr> <ABFED3B4-D37D-4498-9280-3C071EB00892@piuha.net> <54C26C8E.50507@cs.tcd.ie>
In-Reply-To: <54C26C8E.50507@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.238.45.72]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Sentrion-Hostname: mailusrhubprd51.lss.emc.com
X-RSA-Classifications: public
Archived-At: <http://mailarchive.ietf.org/arch/msg/gen-art/yNgeN9tdkinmYpktm0fqwjY8bTw>
Cc: "ietf@ietf.org" <ietf@ietf.org>, "General Area Review Team \(gen-art@ietf.org\)" <gen-art@ietf.org>, "fenix@google.com" <fenix@google.com>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Subject: Re: [Gen-art] Gen-ART and OPS-Dir review of draft-ietf-httpbis-header-compression-10
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Jan 2015 16:52:08 -0000

This sort of guidance will definitely be a useful addition.   A little
more wordsmithing on Stephen's proposed text follows:

  The decision on whether a header field is ok to
  compress or
  not is highly dependent on the context. As a generic
  guidance, header fields used for conveying highly valued
  information, such as the Authorization or Cookie header
  fields, can be considered to be on the more sensitive
  side. In addition, a header field with a short value
  has potentially a smaller entropy and can be more at
  risk. We know that compressing low-entropy sensitive
  header fields can create vulnerabilities so such
  cases are most likely the ones to not compress today.
  Note though that the criteria to apply here may evolve
  over time as we gain knowledge of new attacks.


OLD 
  We know that compressing low-entropy sensitive
  header fields can create vulnerabilities so such
  cases are most likely the ones to not compress today.
  Note though that the criteria to apply here may evolve
  over time as we gain knowledge of new attacks.
NEW
  We currently know that compressing low-entropy sensitive
  header fields can create vulnerabilities so compression
  of such fields ought to be avoided.  
  This guidance may evolve
  over time as we gain knowledge of new attacks.

Thanks,
--David

> -----Original Message-----
> From: Stephen Farrell [mailto:stephen.farrell@cs.tcd.ie]
> Sent: Friday, January 23, 2015 10:45 AM
> To: Jari Arkko; Hervé Ruellan
> Cc: Martin Thomson; Black, David; ietf@ietf.org; General Area Review Team
> (gen-art@ietf.org); fenix@google.com; ietf-http-wg@w3.org
> Subject: Re: [Gen-art] Gen-ART and OPS-Dir review of draft-ietf-httpbis-
> header-compression-10
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> On 23/01/15 15:35, Jari Arkko wrote:
> >
> >> I made a proposal at
> >> https://github.com/http2/http2-spec/pull/704
> >
> > Looked reasonable to me.
> 
> Me too. Quibbling, I'd suggest:
> 
> OLD:
> 
>  The decision on whether a header field is sensitive or
>  not is highly dependent on the context. As a generic
>  guidance, header fields used for conveying highly valued
>  information, such as the Authorization or Cookie header
>  fields, can be considered to be on the more sensitive
>  side. In addition, a header field with a short value
>  has potentially a smaller entropy and can be more at
>  risk.
> 
> NEW:
> 
>  The decision on whether a header field is ok to
>  compress or
>  not is highly dependent on the context. As a generic
>  guidance, header fields used for conveying highly valued
>  information, such as the Authorization or Cookie header
>  fields, can be considered to be on the more sensitive
>  side. In addition, a header field with a short value
>  has potentially a smaller entropy and can be more at
>  risk. We know that compressing low-entropy sensitive
>  header fields can create vulnerabilities so such
>  cases are most likely the ones to not compress today.
>  Note though that the criteria to apply here may evolve
>  over time as we gain knowledge of new attacks.
> 
> Cheers,
> S.
> 
> 
> 
> 
> >
> > jari
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> 
> iQEcBAEBAgAGBQJUwmyOAAoJEC88hzaAX42iJKkIAJtbLdBsQe12+yyg47yupU9x
> xbJJ8WZj7vN9Owc9DbzPUczcejjxPUETWwiJ4gzGEnqOTgkH4Ljbt3DnZO1OrdwL
> J5sdie+/x85WuimEgz8GLeOvHe3vyKAJzRIGuX4c4PFgxQ2EBQTJwMM9/qBx9Wp4
> gLNSMmvd0DT8mfozQokju4H4SsxEgFWIERpDO1Has/3ska0u0qhCrJgIdSSWWn08
> yvsjoPDfp+SPEJOa+vWoWqP971QXaGsm5lnhPDLTJ+u06cWpzeQerOEmS3dMYX4A
> 0gcR73olUgS9gqVQ/HIYDKLxsOX3DXH0QSJhHOgYrE6GNPUX2bz7npN0PP7+x0s=
> =Txbn
> -----END PGP SIGNATURE-----