Re: [quicwg/base-drafts] QPACK security considerations (#3575)

Bence Béky <> Wed, 22 April 2020 13:40 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9E50A3A0C95 for <>; Wed, 22 Apr 2020 06:40:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.482
X-Spam-Status: No, score=-1.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 4x3_0CyQ9ZpA for <>; Wed, 22 Apr 2020 06:40:55 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1B97E3A0C94 for <>; Wed, 22 Apr 2020 06:40:54 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id BEC6C521A9A for <>; Wed, 22 Apr 2020 06:40:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1587562853; bh=MYOEfsZvFAg/311aSDtoUYccltkPpdDrC9N0mOMNVLE=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=zrcq1BQlCzuBrurl7rAmT6gdOm2qabuKC95bA+whcU07reFNHqm4gVUOpWkHNGWpL yL05Sy0Xaf2hHlvYOcQw/ioiclYyCFRMYwpFz1nDqKyfZfy5c/sDboyUTWJHEs5wVC 9aczjx0vc+62sQLXPlDRkhZnb/FivbAfcoQUiVb8=
Date: Wed, 22 Apr 2020 06:40:53 -0700
From: Bence Béky <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3575/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] QPACK security considerations (#3575)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5ea04965afad5_700f3fa657ecd96021744"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: bencebeky
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 22 Apr 2020 13:40:57 -0000

@bencebeky approved this pull request.

> +information (see [PETAL]).
+## Memory Consumption
+An attacker can try to cause an endpoint to exhaust its memory. QPACK is
+designed to limit both the peak and stable amounts of memory allocated by an
+The amount of memory used by the compressor is limited by the protocol using
+QPACK through the definition of the maximum size of the dynamic table, and the
+maximum number of blocking streams. In HTTP/3, these values are controlled by
+the decoder through the setting parameter SETTINGS_QPACK_MAX_TABLE_CAPACITY and
+{{maximum-dynamic-table-capacity}} and {{blocked-streams}}). The limit on the
+size of the dynamic table takes into account both the size of the data stored in
+the dynamic table, plus a small allowance for overhead.  The limit on the number

"both" does not flow well with "plus".  Either s/", plus"/" and"/, or remove "both".

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: