[Ohai] Re: Chunked OHTTP with zero-length chunks

[Lucas Pardue <[e-mail]>]

I don't have an ohttp implementation but agree on the security issues of redundant or confusing encoding and message framing. +1 be strict.

FWIW some of the code I'm responsible for has APIs to prevent sending non-final 0-length DATA frames etc. So this is some familiar territory. 

Cheers
Lucas

On Tue, Nov 25, 2025, at 13:52, Richard Barnes wrote:
> It is late, but this seems like an important interoperability concern.  So let's give this a week or two to confirm there's consensus (say around the strict approach) and then implement.
> 
> If the authors wanted to draft a PR, that would probably help clarify the discussion.
> 
> --Richard
> 
> On Mon, Nov 24, 2025 at 9:07 PM David Schinazi <[e-mail]> wrote:
>> I would suggest taking the strict approach if the authors of the deployed implementations know they're not sending empty chunks.
>> 
>> Google's in-progress implementation hasn't shipped yet, and we'll make sure to not send any empty chunks.
>> 
>> David
>> 
>> On Mon, Nov 24, 2025 at 5:14 PM Martin Thomson <[e-mail]> wrote:
>>> One of the less-nice things about this format is that it is possible to encode a zero-length chunk.  That is, a chunk that contains only the AEAD tag, no data.
>>> 
>>> Discussion on https://github.com/ietf-wg-ohai/draft-ohai-chunked-ohttp/pull/50 indicates that at least two implementations had bugs in this area.  Note that typical streaming APIs treat a zero-length return from a read as a stream termination, so this could even be exploited to abuse stacks.
>>> 
>>> Two choices:
>>> 
>>> 1. Advise against accepting zero-length chunks, as the above PR does.
>>> 2. Ban them entirely.  Aside from the final chunk, which might need to be empty as stream termination is a separate event from data delivery in many implementations.
>>> 
>>> I can't think of a reason not to take the stricter approach.  But it's very late.
>>> 
>>> -- 
>>> Ohai mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>> -- 
>> Ohai mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
> -- 
> Ohai mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>