Re: [secdir] Secdir review of draft-murchison-nntp-compress-05

[Julien ÉLIE <[e-mail]>]

Hi Barry,

Thanks for your answer.  I'll have a deeper look at it soon.

As for the remaining "small points" of rewording (SHOULD, MUST, etc.), 
I'll calmly see them when updating the draft after Last Call.  In case I 
have a doubt for the best wording, I'll ask Ken (co-author) and Michael 
(write-up shepherd) their preference.  We'll obviously manage to come up 
with the "final" rewording as we'll have 3 votes for 2 choices.


Now that I think about it, wouldn't it be worth adding something about 
possible "out of memory" attacks in the Security Considerations Section?

According to <http://zlib.net/zlib_tech.html>, "a 50MB file filled with 
zeros [...] a version of run-length encoding optimized for this sort of 
unusual data file [...] could encode the test file in five bytes. That 
would be a compression factor of 10,000,000:1".
So sending just 5 bytes may require an expansion to 50MB.

Implementations therefore really need to check that the uncompressed 
data does not exceed an upper bound limit.

RFC 1951 (DEFLATE) does not mention it in its Security Considerations, 
and I don't remember having seen that in other RFCs too.  Maybe we 
should say a word for it in the NNTP COMPRESS extension.

-- 
Julien ÉLIE

« Un voyage de mille lieues commence toujours par un premier pas. »
   (Lao Zi)