[Ohai] Re: Chunked OHTTP with zero-length chunks

[Martin Thomson <[e-mail]>]

As for the PR: https://github.com/ietf-wg-ohai/draft-ohai-chunked-ohttp/pull/53

To save you a click, this just adds:

+A non-final chunk MUST NOT contain a zero-length plaintext.
+A receiver MUST treat the receipt of a chunk that contains no data
+as equivalent to a decryption error,
+unless that chunk is the final chunk.

On Wed, Nov 26, 2025, at 03:23, Tommy Pauly wrote:
> The implementation I have for chunked OHTTP already skips sending any 
> chunks if the content of the chunk is zero-length. So, I’m fine with 
> this being defined to be strict and prohibit zero-length chunks apart 
> from the final chunk.
>
> Tommy
>
>> On Nov 25, 2025, at 6:52 AM, Lucas Pardue <[e-mail]> wrote:
>> 
>> I don't have an ohttp implementation but agree on the security issues of redundant or confusing encoding and message framing. +1 be strict.
>> 
>> FWIW some of the code I'm responsible for has APIs to prevent sending non-final 0-length DATA frames etc. So this is some familiar territory. 
>> 
>> Cheers
>> Lucas
>> 
>> On Tue, Nov 25, 2025, at 13:52, Richard Barnes wrote:
>>> It is late, but this seems like an important interoperability concern.  So let's give this a week or two to confirm there's consensus (say around the strict approach) and then implement.
>>> 
>>> If the authors wanted to draft a PR, that would probably help clarify the discussion.
>>> 
>>> --Richard
>>> 
>>> On Mon, Nov 24, 2025 at 9:07 PM David Schinazi <[e-mail]> wrote:
>>>> I would suggest taking the strict approach if the authors of the deployed implementations know they're not sending empty chunks.
>>>> 
>>>> Google's in-progress implementation hasn't shipped yet, and we'll make sure to not send any empty chunks.
>>>> 
>>>> David
>>>> 
>>>> On Mon, Nov 24, 2025 at 5:14 PM Martin Thomson <[e-mail]> wrote:
>>>>> One of the less-nice things about this format is that it is possible to encode a zero-length chunk.  That is, a chunk that contains only the AEAD tag, no data.
>>>>> 
>>>>> Discussion on https://github.com/ietf-wg-ohai/draft-ohai-chunked-ohttp/pull/50 indicates that at least two implementations had bugs in this area.  Note that typical streaming APIs treat a zero-length return from a read as a stream termination, so this could even be exploited to abuse stacks.
>>>>> 
>>>>> Two choices:
>>>>> 
>>>>> 1. Advise against accepting zero-length chunks, as the above PR does.
>>>>> 2. Ban them entirely.  Aside from the final chunk, which might need to be empty as stream termination is a separate event from data delivery in many implementations.
>>>>> 
>>>>> I can't think of a reason not to take the stricter approach.  But it's very late.
>>>>> 
>>>>> -- 
>>>>> Ohai mailing list -- [e-mail]
>>>>> To unsubscribe send an email to [e-mail]
>>>> -- 
>>>> Ohai mailing list -- [e-mail]
>>>> To unsubscribe send an email to [e-mail]
>>> -- 
>>> Ohai mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>>> 
>> 
>> -- 
>> Ohai mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>
> -- 
> Ohai mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]