Subject: Padding for PUSH_PROMISE frames

From: Nicholas Hurley <[email-masked]>
Date: Thu, 13 Feb 2014 21:26:23 -0800

All,

Right now (as of draft-10), DATA, HEADERS, and CONTINUATION frames can
contain padding to obscure the actual size of the data being sent. I
believe it would make sense to also add the option for padding to
PUSH_PROMISE frames, as they carry (pretty much) the same type of payload
as HEADERS frames, and can benefit from padding in the same way.

I can make a pull request if others think this is a good idea.

Thoughts?
-Nick

---

From: Jeff Pinner <[email-masked]>
Date: Thu, 13 Feb 2014 21:39:15 -0800

Should we consider adding padding to all frames?

We have two bits reserved at the beginning of the length field that we
could use for the two padding flags, independent of frame type.

---

From: Roberto Peon <[email-masked]>
Date: Thu, 13 Feb 2014 23:42:08 -0800

I can see an argument for it but... meh. Padding is not a security feature
unless it is used right. Adding it everywhere doesn't really help that, and
opens up stuff even wider for abuse in the myriad cases where it has no
real security benefit.

-=R

---

From: Nicholas Hurley <[email-masked]>
Date: Fri, 14 Feb 2014 14:01:09 -0800

I thought about adding padding to everything, but like Roberto said, it
gets even trickier to do correctly (i.e., without messing up the security
properties), and it seems a little silly to me to add padding to a frame
that has a constant size. Adding it to PUSH_PROMISE, though, allows hiding
the true size of the promised headers, and makea processing of both that
and HEADERS frames almost the same, conceivably simplifying  implementation.
I can see an argument for it but... meh. Padding is not a security feature
unless it is used right. Adding it everywhere doesn't really help that, and
opens up stuff even wider for abuse in the myriad cases where it has no
real security benefit.

-=R

---

From: Roberto Peon <[email-masked]>
Date: Fri, 14 Feb 2014 14:06:17 -0800

Yup. Padding should be on any frame including a headers block, plus the
data frame.
-=R

---

From: Ryan Hamilton <[email-masked]>
Date: Fri, 14 Feb 2014 14:11:43 -0800

Would it make sense to consider adding an explicit padding frame instead of
adding padding *to* existing frames?

On Fri, Feb 14, 2014 at 2:06 PM, Roberto Peon <[email-masked]> wrote:

>>  I can see an argument for it but... meh. Padding is not a security
>> feature unless it is used right. Adding it everywhere doesn't really help
>> that, and opens up stuff even wider for abuse in the myriad cases where it
>> has no real security benefit.
>>
>> -=R
>>
>>

---

From: Roberto Peon <[email-masked]>
Date: Fri, 14 Feb 2014 14:13:37 -0800

Consider? Sure, however the downside is that we lose information because we
have a minimum padding of 8 bytes instead of of minimum padding of 1 byte.
I believe that there would probably be interesting side-channel attacks
against the padding mechanism if it was always a minimum of 8 bytes unless
we added padding to 8-byte-boundaries to all frames..
.. and that would be a waste.

-=R

On Fri, Feb 14, 2014 at 2:11 PM, Ryan Hamilton <[email-masked]> wrote:

> Would it make sense to consider adding an explicit padding frame instead
> of adding padding *to* existing frames?
>
>
>>> On Thu, Feb 13, 2014 at 9:39 PM, Jeff Pinner <[email-masked]>wrote:
>>>
>>>> On Thu, Feb 13, 2014 at 9:26 PM, Nicholas Hurley <[email-masked]
>>>> > wrote:
>>>>
>>>>> All,
>>>>>

---

From: Martin Thomson <[email-masked]>
Date: Fri, 14 Feb 2014 14:22:26 -0800

On 14 February 2014 14:06, Roberto Peon <[email-masked]> wrote:
> Yup. Padding should be on any frame including a headers block, plus the data
> frame.

I think that this was mostly just a mistake actually.

https://github.com/http2/http2-spec/commit/29bde7427df79b978c841b923191fc1a0ea8c150

---

From: Martin Thomson <[email-masked]>
Date: Fri, 14 Feb 2014 14:23:07 -0800

> https://github.com/http2/http2-spec/commit/29bde7427df79b978c841b923191fc1a0ea8c150

Sorry, this == missing PUSH_PROMISE.  The above commit rectifies the mistake.

---

From: Ryan Hamilton <[email-masked]>
Date: Fri, 14 Feb 2014 14:33:09 -0800

Ah, right!  Good point.

On Fri, Feb 14, 2014 at 2:13 PM, Roberto Peon <[email-masked]> wrote:

> Consider? Sure, however the downside is that we lose information because
> we have a minimum padding of 8 bytes instead of of minimum padding of 1
> byte.
>>>>> On Thu, Feb 13, 2014 at 9:26 PM, Nicholas Hurley <
>>>>> [email-masked]> wrote:
>>>>>
>>>>>> All,
>>>>>>
>>>>>> Right now (as of draft-10), DATA, HEADERS, and CONTINUATION frames
>>>>>> can contain padding to obscure the actual size of the data being sent. I