Re: Secdir last call review of draft-ietf-httpbis-zstd-window-size-01
Nidhi Jaju <nidhijaju@google.com> Wed, 31 July 2024 02:02 UTC
Received: by ietfa.amsl.com (Postfix) id 4E0E7C18DB9B; Tue, 30 Jul 2024 19:02:34 -0700 (PDT)
Delivered-To: ietfarch-httpbisa-archive-bis2juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CF56C18DB92 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 30 Jul 2024 19:02:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.36
X-Spam-Level:
X-Spam-Status: No, score=-10.36 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=w3.org header.b="kZoNbSvw"; dkim=pass (2048-bit key) header.d=w3.org header.b="nPCDJtuc"; dkim=pass (2048-bit key) header.d=google.com header.b="aruLn6fd"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ReYgc9T2jEnf for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 30 Jul 2024 19:02:33 -0700 (PDT)
Received: from mab.w3.org (mab.w3.org [IPv6:2600:1f18:7d7a:2700:d091:4b25:8566:8113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9037DC1840C3 for <httpbisa-archive-bis2Juki@ietf.org>; Tue, 30 Jul 2024 19:02:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:Content-Type:Cc:To:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To; bh=z11kzH52ijo4kG0yrvP2d3RHVppigvVtNzFpakELSx8=; b=kZoNbSvw0aNwaNrBQbXxqFDAD/ SSrKzBHV66t7ALzLWTTXmyOfR1OugDtLe8TnOMOprJWt0C/xNnT/31RZRSk4bJwGpTk1wr4FLDpHh 8YHlHilyV/PYSSdbbmUpwoHi5Sw91cMYn6nriN3dUvR1yeU/pyEVytuJosofbUtJ2P4tIdDJjrJAO Ou8GgV1Zo6hnriyesYTAcC+5tYS5sXm7LrjL568RYE95CbeUyilTALBhwwampg+0IbjP7ksIzMMq3 5FEkMLotS5yQUMrURjRYxpKBk/UVknIYFROI3VkS1do+bpp4TG906UQwDqjoeQzKB/ePvQDMP2YFs DDPtioSA==;
Received: from lists by mab.w3.org with local (Exim 4.96) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1sYyem-0038tp-0R for ietf-http-wg-dist@listhub.w3.org; Wed, 31 Jul 2024 02:01:36 +0000
Resent-Date: Wed, 31 Jul 2024 02:01:36 +0000
Resent-Message-Id: <E1sYyem-0038tp-0R@mab.w3.org>
Received: from ip-10-0-0-144.ec2.internal ([10.0.0.144] helo=pan.w3.org) by mab.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <nidhijaju@google.com>) id 1sYyek-0038t2-1A for ietf-http-wg@listhub.w3.internal; Wed, 31 Jul 2024 02:01:34 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Content-Type:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To; bh=z11kzH52ijo4kG0yrvP2d3RHVppigvVtNzFpakELSx8=; t=1722391294; x=1723255294; b=nPCDJtucP1GHgsh+HRuE3kcPkor7fRokpGbuY9lH71J7XvFYWBcsO7fYdrvd2vuYL0WHUJgM9ou ou7KfCD+O4XUAIjBwyp3Y5MHA/7qzK1OJ3qHihs2uRJQjiKTRMWZ6Ip3PJIYJmEcq1GGMcKhXQmZ/ uxUgT46dt5zBzGxFKlNCrZZxtZcZzg2d3N1nHdyrohPoXtl/4bw0wd9LohDbhBH3yg0I+GKVMRx28 NKMJ5kMNrQ+UupndqRDMGgxiC3K4Y1TmcZE+E2t3Xu2/C0m0LmzrC9v893XPVW57vIFYuQ9ldlFl4 me6QilwmmmxVtsauG1oI2o+qmQn8SoArpKrw==;
Received-SPF: pass (pan.w3.org: domain of google.com designates 2a00:1450:4864:20::52d as permitted sender) client-ip=2a00:1450:4864:20::52d; envelope-from=nidhijaju@google.com; helo=mail-ed1-x52d.google.com;
Received: from mail-ed1-x52d.google.com ([2a00:1450:4864:20::52d]) by pan.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from <nidhijaju@google.com>) id 1sYyej-00EvWR-2R for ietf-http-wg@w3.org; Wed, 31 Jul 2024 02:01:34 +0000
Received: by mail-ed1-x52d.google.com with SMTP id 4fb4d7f45d1cf-5a28b61b880so7595a12.1 for <ietf-http-wg@w3.org>; Tue, 30 Jul 2024 19:01:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1722391289; x=1722996089; darn=w3.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=z11kzH52ijo4kG0yrvP2d3RHVppigvVtNzFpakELSx8=; b=aruLn6fdIxBDUD6KuC8gt0/uzFU3SYfWN59V1ouW1KfvKrUEd09++rSSfXJc6WcEx6 CxWXHBeafh8Cshnd1c9BdxDiwwMKoTqHXahGTjxyP/NU0YmBAkgpiiyWLppb3kxXhq4B 5ee7SIIiyiYUIQGcGweQ3e9LUiM06kZs2Gz51PXyvOMzVsYW88C2Pw1GObv4popckjEB S2du78Afp51lxJkl/bzs5NEcwubZ0lEkZSrJn0Eo8bTxMjFFv+d+AXOiBaFzmhJaj94f JflyAtvdS28IAvSG7Yjefiixs4A1YIm8zQj1Sx3PMtCvPZDbXk786ibqPOJgiwK8aPhT iqdQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722391289; x=1722996089; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=z11kzH52ijo4kG0yrvP2d3RHVppigvVtNzFpakELSx8=; b=kBU2ghmIcqfiHTg4bDt0rOYtJG8jq08s9FJH+BkSTAGeyR+5MkmZjCyVDb/4JjwHdv lKjRIQAY8JghpGnInujods0vPMKQ+M19boIIePfCLpjrZqw37y4ZVqcBBuOT0HeTTLDq rfgeYuG83BHvbAA383er6SM7mlzS0vFSyw1oabZcLZ0VKRNxSYC36CLUzjpa/8K/3aFE GmaMaCJt5Q23uXhy63umAPbTEdi0vWTvCV1E87TFOQZ8P3bKJTl5WsQnDKPNhPPmrjlf DexnyPKJRWEYFiQ4xOhcx1ncvZnIa641pJYmCz+ijmE70dLCeWYW/tRV5mwn66XbzR7z qdDQ==
X-Forwarded-Encrypted: i=1; AJvYcCXGf/EwX5zew08HoDCpSvqf7KE7BQuBMMo1mpw7YEIJmJ+6jTcyaqHvGNueJgs3Zgk+Sb+WOsGXNeF806YIzJvmTRsn
X-Gm-Message-State: AOJu0Yz9edBvH8GtA+EQg6zU6MBAMQTWAmukeFy/js96yfacWq2M8Rhk euKcXoaxac+36+yOeNTLcMRxkTw4VRBoSk7syJfTfyseDeY/+zBSUuCZlPKZiOxFV+hRk2jTsKC VSVhH0v7mh35TAETiLtM/vn+a4vQQ+LvnsGagiOjHVqOrdUxXxw==
X-Google-Smtp-Source: AGHT+IH3TWYO7mzu+4aSRtNYbhRrj2KwJZfebdUAMRaMLY5Mvq04pza2XRmy8btcrlg3qIOms/8mVKv8z+QhXWco0rk=
X-Received: by 2002:a05:6402:27cd:b0:57c:c3a7:dab6 with SMTP id 4fb4d7f45d1cf-5b5b4a6a671mr35106a12.3.1722391289097; Tue, 30 Jul 2024 19:01:29 -0700 (PDT)
MIME-Version: 1.0
References: <172236234726.1988233.10638684912150320147@dt-datatracker-659f84ff76-9wqgv>
In-Reply-To: <172236234726.1988233.10638684912150320147@dt-datatracker-659f84ff76-9wqgv>
From: Nidhi Jaju <nidhijaju@google.com>
Date: Wed, 31 Jul 2024 11:01:17 +0900
Message-ID: <CAHARgnK+U2ePx-V=iL9=GbrahXXvkKLKgyGX9ZiyomCxb13mhQ@mail.gmail.com>
To: Tim Hollebeek <tim.hollebeek@digicert.com>
Cc: secdir@ietf.org, draft-ietf-httpbis-zstd-window-size.all@ietf.org, ietf-http-wg@w3.org, last-call@ietf.org
Content-Type: multipart/alternative; boundary="000000000000f416c1061e81783c"
X-W3C-Hub-DKIM-Status: validation passed: (address=nidhijaju@google.com domain=google.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-21.6
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_WL=-1
X-W3C-Scan-Sig: pan.w3.org 1sYyej-00EvWR-2R 41cf7325f3f55a5d8632671a2d732177
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Secdir last call review of draft-ietf-httpbis-zstd-window-size-01
Archived-At: <https://www.w3.org/mid/CAHARgnK+U2ePx-V=iL9=GbrahXXvkKLKgyGX9ZiyomCxb13mhQ@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/52168
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
Thank you for the review and feedback! I filed an issue <https://github.com/httpwg/http-extensions/issues/2849> with some proposed text to add to the security considerations section. Suggestions are welcome :) Best, Nidhi On Wed, Jul 31, 2024 at 2:59 AM Tim Hollebeek via Datatracker < noreply@ietf.org> wrote: > Reviewer: Tim Hollebeek > Review result: Ready > > This is rather unimportant, but I just wanted to mention it in case the > authors > find it useful. Feel free to ignore. > > The document states that there are no new security considerations, but > that's > perhaps not quite true. I think it might be useful to call out that an > implementation cannot rely on its peer behaving correctly, so implementers > will > have to take into account they may still receive oversized frames from > misbehaving clients. This is arguably no different from the situation > today, so > it can be argued that the current considerations are accurate. > > I just thought it might be useful to call it out so some engineer doesn't > remove validation checks since the other side is supposed to behave now. > Just > because we have standards, doesn't mean that everyone complies. >
- Secdir last call review of draft-ietf-httpbis-zst… Tim Hollebeek via Datatracker
- Re: Secdir last call review of draft-ietf-httpbis… Nidhi Jaju