[saag] New I-D: Security Considerations Regarding Compression Dictionaries

["W. Felix Handte" <[e-mail]>]

Hello all,

For a year now, I've been discussing in the http wg the possibility of 
specifying a new content-encoding for http traffic that uses 
dictionary-based compression. (Dictionary-based compression is a really 
powerful tool that we've had a lot of success deploying internally at 
Facebook and that is seeing increasing adoption elsewhere [0].)

To make a long story short: this is not a new idea. There have been a 
number of previous attempts at specifying a better compression scheme 
for HTTP that relies on external state. Of those proposals, most have 
met their demise at the hands of security concerns. The common refrain 
has been that the security implications are not well understood, and 
that until they are, any dictionary-based compression scheme will be 
viewed with a great deal of suspicion.

Accordingly, I have been working to perform a security analysis of 
dictionary-based compression in the context of internet protocols, and 
have just published a draft [1]. Your feedback, thoughts, etc. are 
greatly appreciated!

I will be presenting this at httpbis session 2 in Singapore. It was 
suggested to me that this work might also be of interest to this group. 
If it makes sense, I would be happy to present and discuss it in 
Singapore with the SAAG WG as well.

Thanks,
Felix

[0] https://engineering.fb.com/core-data/zstandard/
[1] https://datatracker.ietf.org/doc/draft-handte-httpbis-dict-sec/