Draft: rfc9204

Commentary: Addresses most of the open RFC Editor questions . 
 Need to update  's contact information to . 
 Fixed in . 
 This is a change in the RFC Editor diff that I do n't think works ; pulling out for separate discussion . Original : Proposed but incorrect : The intended reading is : For ... HTTP/3 servers ( always , regardless of 0 - RTT ) and HTTP/3 clients when 0 - RTT is not attempted or is rejected maximum table capacity is 0 . 
 Fixed in . 
 Should the following text be formatted using < aside ? See the definition at Original : Note : Padding schemes only provide limited protection against an attacker with these capabilities , potentially only forcing an increased number of guesses to learn the length associated with a given guess . Padding schemes also work directly against compression by increasing the number of bits that are transmitted . Original : Note : Simply removing entries corresponding to the field from the dynamic table can be ineffectual if the attacker has a reliable way of causing values to be reinstalled . For example , a request to load an image in a web browser typically includes the Cookie header field ( a potentially highly valued target for this sort of attack ) , and websites can easily force an image to be loaded , thereby refreshing the entry in the dynamic table . 
 Probably yes . 
 Fixed in . 
 May we update "  - coded " with "  encoded " in this text to match other uses ? Original : They begin with a single bit flag , denoted as ' H ' in this document ( indicating whether the string is Huffman - coded ) , followed by the  encoded as a 7 - bit prefix integer , and finally  bytes of data . 
 Fixed in .
Paragraph (version A):
For HTTP/3 servers and HTTP/3 clients when 0-RTT is not attempted or
is rejected, the maximum table capacity is 0 until the encoder
processes a SETTINGS frame with a non-zero value of
SETTINGS_QPACK_MAX_TABLE_CAPACITY.
Paragraph (version B):
For clients not using 0-RTT data (whether 0-RTT is not attempted or
is rejected) and for all HTTP/3 servers, the maximum table capacity
is 0 until the encoder processes a SETTINGS frame with a non-zero
value of SETTINGS_QPACK_MAX_TABLE_CAPACITY.
Paragraph (version A):
HPACK defines string literals to begin on a byte boundary.  They
begin with a single bit flag, denoted as 'H' in this document
(indicating whether the string is Huffman-coded), followed by the
Length encoded as a 7-bit prefix integer, and finally Length bytes of
data.  When Huffman encoding is enabled, the Huffman table from
Section B of RFC7541 is used without modification and Length
indicates the size of the string after encoding.
Paragraph (version B):
HPACK defines string literals to begin on a byte boundary.  They
begin with a single bit flag, denoted as 'H' in this document
(indicating whether the string is Huffman encoded), followed by the
Length encoded as a 7-bit prefix integer, and finally Length bytes of
data.  When Huffman encoding is enabled, the Huffman table from
Section B of RFC7541 is used without modification and Length
indicates the size of the string after encoding.
Paragraph (version A):
Padding schemes only provide limited protection against an
attacker with these capabilities, potentially only forcing an
increased number of guesses to learn the length associated with a
given guess.  Padding schemes also work directly against
compression by increasing the number of bits that are transmitted.
Paragraph (version B):
Note: Padding schemes only provide limited protection against an
attacker with these capabilities, potentially only forcing an
increased number of guesses to learn the length associated with a
given guess.  Padding schemes also work directly against
compression by increasing the number of bits that are transmitted.
Paragraph (version A):
Simply removing entries corresponding to the field from the
dynamic table can be ineffectual if the attacker has a reliable
way of causing values to be reinstalled.  For example, a request
to load an image in a web browser typically includes the Cookie
header field (a potentially highly valued target for this sort of
attack), and websites can easily force an image to be loaded,
thereby refreshing the entry in the dynamic table.