Draft: rfc9114

Commentary: This PR contains , as best I can , the content and XML changes made by the RFC Editor during Auth48 , including those I disagree with . I 'll note and propose reversions where appropriate . Things not addressed : In Section 1.2 , the RFC Editor to the tag ; I 'm not sure how to do that from Markdown The change in was pulled out into a separate issue . 
 This is a change in the RFC Editor diff that I do n't think works ; pulling out for separate discussion . Original : Proposed but incorrect : The intended reading is : For ... HTTP/3 servers ( always , regardless of 0 - RTT ) and HTTP/3 clients when 0 - RTT is not attempted or is rejected maximum table capacity is 0 . 
 Fixed in . 
 Note that we updated instances of ' artwork type="drawing " ' to type="ascii - art " . However , we wonder if any of these should be tagged as sourcecode instead . Please review . Original ( in the XML ): < artwork type="drawing " name= " " align="left " alt=""See more information about sourcecode . 
 In H3 , I went with ascii - art for all of them . However , QPACK includes some fairly substantial pseudocode . These should probably be instead . 
 Fixed in .
Paragraph (version A):
Two stream types are defined in this document: (control-streams) and
(push-streams).  QPACK defines two additional stream types.  Other
stream types can be defined by extensions to HTTP/3; see extensions
for more details.  Some stream types are reserved (stream-grease).
Paragraph (version B):
Two stream types are defined in this document: control streams
(control-streams) and (push-streams).  QPACK defines two additional
stream types.  Other stream types can be defined by extensions to
HTTP/3; see extensions for more details.  Some stream types are
reserved (stream-grease).
Paragraph (version A):
This specification defines QPACK, a compression format for
efficiently representing HTTP fields, to be used in HTTP/3.  This is
a variation of HPACK compression that seeks to reduce head-of-line
blocking.
Paragraph (version B):
This specification defines QPACK: a compression format for
efficiently representing HTTP fields that is to be used in HTTP/3.
This is a variation of HPACK compression that seeks to reduce head-
of-line blocking.
Paragraph (version A):
QPACK is a name, not an acronym.
Paragraph (version A):
Indicates that x is variable-length and extends to the end of the
region.
Paragraph (version B):
Note that QPACK is a name, not an abbreviation.
Paragraph (version B):
Indicates that x is A bits long.
Paragraph (version B):
Indicates that x is variable length and extends to the end of the
region.
Paragraph (version A):
To ensure that the encoder is not prevented from adding new entries,
the encoder can avoid referencing entries that are close to eviction.
Rather than reference such an entry, the encoder can emit a Duplicate
instruction (duplicate), and reference the duplicate instead.
Paragraph (version B):
To ensure that the encoder is not prevented from adding new entries,
the encoder can avoid referencing entries that are close to eviction.
Rather than reference such an entry, the encoder can emit a Duplicate
instruction (duplicate) and reference the duplicate instead.
Paragraph (version A):
When the decoder receives an encoded field section with a Required
Insert Count greater than its own Insert Count, the stream cannot be
processed immediately, and is considered "blocked"; see blocked-
decoding.
Paragraph (version B):
When the decoder receives an encoded field section with a Required
Insert Count greater than its own Insert Count, the stream cannot be
processed immediately and is considered "blocked"; see blocked-
decoding.
Paragraph (version A):
An encoder can decide whether to risk having a stream become blocked.
If permitted by the value of SETTINGS_QPACK_BLOCKED_STREAMS,
compression efficiency can often be improved by referencing dynamic
table entries that are still in transit, but if there is loss or
reordering the stream can become blocked at the decoder.  An encoder
can avoid the risk of blocking by only referencing dynamic table
entries that have been acknowledged, but this could mean using
literals.  Since literals make the encoded field section larger, this
can result in the encoder becoming blocked on congestion or flow
control limits.
Paragraph (version B):
An encoder can decide whether to risk having a stream become blocked.
If permitted by the value of SETTINGS_QPACK_BLOCKED_STREAMS,
compression efficiency can often be improved by referencing dynamic
table entries that are still in transit, but if there is loss or
reordering, the stream can become blocked at the decoder.  An encoder
can avoid the risk of blocking by only referencing dynamic table
entries that have been acknowledged, but this could mean using
literals.  Since literals make the encoded field section larger, this
can result in the encoder becoming blocked on congestion or flow-
control limits.
Paragraph (version A):
A decoder might stop issuing flow control credit on the stream that
carries an encoded field section until the necessary updates are
received on the encoder stream.  If the granting of flow control
credit on the encoder stream (or the connection as a whole) depends
on the consumption and release of data on the stream carrying the
encoded field section, a deadlock might result.
Paragraph (version A):
More generally, a stream containing a large instruction can become
deadlocked if the decoder withholds flow control credit until the
instruction is completely received.
Paragraph (version A):
To avoid these deadlocks, an encoder SHOULD NOT write an instruction
unless sufficient stream and connection flow control credit is
available for the entire instruction.
Paragraph (version B):
A decoder might stop issuing flow-control credit on the stream that
carries an encoded field section until the necessary updates are
received on the encoder stream.  If the granting of flow-control
credit on the encoder stream (or the connection as a whole) depends
on the consumption and release of data on the stream carrying the
encoded field section, a deadlock might result.
Paragraph (version B):
More generally, a stream containing a large instruction can become
deadlocked if the decoder withholds flow-control credit until the
instruction is completely received.
Paragraph (version B):
To avoid these deadlocks, an encoder SHOULD NOT write an instruction
unless sufficient stream and connection flow-control credit is
available for the entire instruction.
Paragraph (version A):
A Section Acknowledgment instruction (header-acknowledgment) implies
that the decoder has received all dynamic table state necessary to
decode the field section.  If the Required Insert Count of the
acknowledged field section is greater than the current Known Received
Count, Known Received Count is updated to that Required Insert Count
value.
Paragraph (version B):
A Section Acknowledgment instruction (header-acknowledgment) implies
that the decoder has received all dynamic table state necessary to
decode the field section.  If the Required Insert Count of the
acknowledged field section is greater than the current Known Received
Count, the Known Received Count is updated to that Required Insert
Count value.
Paragraph (version A):
While blocked, encoded field section data SHOULD remain in the
blocked stream's flow control window.  This data is unusable until
the stream becomes unblocked, and releasing the flow control
prematurely makes the decoder vulnerable to memory exhaustion
attacks.  A stream becomes unblocked when the Insert Count becomes
greater than or equal to the Required Insert Count for all encoded
field sections the decoder has started reading from the stream.
Paragraph (version B):
While blocked, encoded field section data SHOULD remain in the
blocked stream's flow-control window.  This data is unusable until
the stream becomes unblocked, and releasing the flow control
prematurely makes the decoder vulnerable to memory exhaustion
attacks.  A stream becomes unblocked when the Insert Count becomes
greater than or equal to the Required Insert Count for all encoded
field sections the decoder has started reading from the stream.
Paragraph (version A):
The Section Acknowledgment and Stream Cancellation instructions
permit the encoder to remove references to entries in the dynamic
table.  When an entry with absolute index lower than the Known
Received Count has zero references, then it is considered evictable;
see blocked-insertion.
Paragraph (version B):
The Section Acknowledgment and Stream Cancellation instructions
permit the encoder to remove references to entries in the dynamic
table.  When an entry with an absolute index lower than the Known
Received Count has zero references, then it is considered evictable;
see blocked-insertion.
Paragraph (version A):
After receiving new table entries on the encoder stream, the decoder
chooses when to emit Insert Count Increment instructions; see insert-
count-increment.  Emitting this instruction after adding each new
dynamic table entry will provide the timeliest feedback to the
encoder, but could be redundant with other decoder feedback.  By
delaying an Insert Count Increment instruction, the decoder might be
able to coalesce multiple Insert Count Increment instructions, or
replace them entirely with Section Acknowledgments; see header-
acknowledgment.  However, delaying too long may lead to compression
inefficiencies if the encoder waits for an entry to be acknowledged
before using it.
Paragraph (version B):
After receiving new table entries on the encoder stream, the decoder
chooses when to emit Insert Count Increment instructions; see insert-
count-increment.  Emitting this instruction after adding each new
dynamic table entry will provide the timeliest feedback to the
encoder, but could be redundant with other decoder feedback.  By
delaying an Insert Count Increment instruction, the decoder might be
able to coalesce multiple Insert Count Increment instructions or
replace them entirely with Section Acknowledgments; see header-
acknowledgment.  However, delaying too long may lead to compression
inefficiencies if the encoder waits for an entry to be acknowledged
before using it.
Paragraph (version A):
When the decoder encounters an invalid static table index in a field
line representation it MUST treat this as a connection error of type
QPACK_DECOMPRESSION_FAILED.  If this index is received on the encoder
stream, this MUST be treated as a connection error of type
QPACK_ENCODER_STREAM_ERROR.
Paragraph (version B):
When the decoder encounters an invalid static table index in a field
line representation, it MUST treat this as a connection error of type
QPACK_DECOMPRESSION_FAILED.  If this index is received on the encoder
stream, this MUST be treated as a connection error of type
QPACK_ENCODER_STREAM_ERROR.
Paragraph (version A):
For clients using 0-RTT data in HTTP/3, the server's maximum table
capacity is the remembered value of the setting, or zero if the value
was not previously sent.  When the client's 0-RTT value of the
SETTING is zero, the server MAY set it to a non-zero value in its
SETTINGS frame.  If the remembered value is non-zero, the server MUST
send the same non-zero value in its SETTINGS frame.  If it specifies
any other value, or omits SETTINGS_QPACK_MAX_TABLE_CAPACITY from
SETTINGS, the encoder must treat this as a connection error of type
QPACK_DECODER_STREAM_ERROR.
Paragraph (version B):
For clients using 0-RTT data in HTTP/3, the server's maximum table
capacity is the remembered value of the setting or zero if the value
was not previously sent.  When the client's 0-RTT value of the
SETTING is zero, the server MAY set it to a non-zero value in its
SETTINGS frame.  If the remembered value is non-zero, the server MUST
send the same non-zero value in its SETTINGS frame.  If it specifies
any other value, or omits SETTINGS_QPACK_MAX_TABLE_CAPACITY from
SETTINGS, the encoder must treat this as a connection error of type
QPACK_DECODER_STREAM_ERROR.
Paragraph (version A):
When the maximum table capacity is zero, the encoder MUST NOT insert
entries into the dynamic table, and MUST NOT send any encoder
instructions on the encoder stream.
Paragraph (version B):
When the maximum table capacity is zero, the encoder MUST NOT insert
entries into the dynamic table and MUST NOT send any encoder
instructions on the encoder stream.
Paragraph (version A):
Post-Base indices are used in field line representations for entries
with absolute indices greater than or equal to Base, starting at 0
for the entry with absolute index equal to Base, and increasing in
the same direction as the absolute index.
Paragraph (version B):
Post-Base indices are used in field line representations for entries
with absolute indices greater than or equal to Base, starting at 0
for the entry with absolute index equal to Base and increasing in the
same direction as the absolute index.
Paragraph (version A):
This document expands the definition of string literals by permitting
them to begin other than on a byte boundary.  An "N-bit prefix string
literal" begins mid-byte, with the first (8-N) bits allocated to a
previous field.  The string uses one bit for the Huffman flag,
followed by the Length encoded as an (N-1)-bit prefix integer.  The
prefix size, N, can have a value between 2 and 8 inclusive.  The
remainder of the string literal is unmodified.
Paragraph (version B):
This document expands the definition of string literals by permitting
them to begin other than on a byte boundary.  An "N-bit prefix string
literal" begins mid-byte, with the first (8-N) bits allocated to a
previous field.  The string uses one bit for the Huffman flag,
followed by the Length encoded as a (N-1)-bit prefix integer.  The
prefix size, N, can have a value between 2 and 8, inclusive.  The
remainder of the string literal is unmodified.
Paragraph (version A):
HTTP/3 endpoints contain a QPACK encoder and decoder.  Each endpoint
MUST initiate at most one encoder stream and at most one decoder
stream.  Receipt of a second instance of either stream type MUST be
treated as a connection error of type H3_STREAM_CREATION_ERROR.
Paragraph (version B):
HTTP/3 endpoints contain a QPACK encoder and decoder.  Each endpoint
MUST initiate, at most, one encoder stream and, at most, one decoder
stream.  Receipt of a second instance of either stream type MUST be
treated as a connection error of type H3_STREAM_CREATION_ERROR.
Paragraph (version A):
An endpoint MAY avoid creating an encoder stream if it will not be
used (for example if its encoder does not wish to use the dynamic
table, or if the maximum size of the dynamic table permitted by the
peer is zero).
Paragraph (version B):
An endpoint MAY avoid creating an encoder stream if it will not be
used (for example, if its encoder does not wish to use the dynamic
table or if the maximum size of the dynamic table permitted by the
peer is zero).
Paragraph (version A):
This is followed by the name represented as a 6-bit prefix string
literal, and the value represented as an 8-bit prefix string literal;
see string-literals.
Paragraph (version B):
This is followed by the name represented as a 6-bit prefix string
literal and the value represented as an 8-bit prefix string literal;
see string-literals.
Paragraph (version A):
The existing entry is re-inserted into the dynamic table without
resending either the name or the value.  This is useful to avoid
adding a reference to an older entry, which might block inserting new
entries.
Paragraph (version B):
The existing entry is reinserted into the dynamic table without
resending either the name or the value.  This is useful to avoid
adding a reference to an older entry, which might block inserting new
entries.
Paragraph (version A):
This instruction is used as described in known-received-count and in
state-synchronization.
Paragraph (version B):
This instruction is used as described in Sections <known-received-
count and <state-synchronization.
Paragraph (version A):
An encoder that receives an Increment field equal to zero, or one
that increases the Known Received Count beyond what the encoder has
sent MUST treat this as a connection error of type
QPACK_DECODER_STREAM_ERROR.
Paragraph (version B):
An encoder that receives an Increment field equal to zero, or one
that increases the Known Received Count beyond what the encoder has
sent, MUST treat this as a connection error of type
QPACK_DECODER_STREAM_ERROR.
Paragraph (version A):
An encoded field section consists of a prefix and a possibly empty
sequence of representations defined in this section.  Each
representation corresponds to a single field line.  These
representations reference the static table or the dynamic table in a
particular state, but do not modify that state.
Paragraph (version B):
An encoded field section consists of a prefix and a possibly empty
sequence of representations defined in this section.  Each
representation corresponds to a single field line.  These
representations reference the static table or the dynamic table in a
particular state, but they do not modify that state.
Paragraph (version A):
TotalNumberOfInserts is the total number of inserts into the
decoder's dynamic table.
Paragraph (version B):
"TotalNumberOfInserts" is the total number of inserts into the
decoder's dynamic table.
Paragraph (version A):
An encoder that produces table updates before encoding a field
section might set Base to the value of Required Insert Count.  In
such case, both the sign bit and the Delta Base will be set to zero.
Paragraph (version B):
An encoder that produces table updates before encoding a field
section might set Base to the value of Required Insert Count.  In
such a case, both the sign bit and the Delta Base will be set to
zero.
Paragraph (version A):
For example, with a Required Insert Count of 9, a decoder receives an
S bit of 1 and a Delta Base of 2.  This sets the Base to 6 and
enables post-base indexing for three entries.  In this example, a
relative index of 1 refers to the 5th entry that was added to the
table; a post-base index of 1 refers to the 8th entry.
Paragraph (version A):
An indexed field line representation identifies an entry in the
static table, or an entry in the dynamic table with an absolute index
less than the value of the Base.
Paragraph (version A):
This representation starts with the '1' 1-bit pattern, followed by
the 'T' bit indicating whether the reference is into the static or
dynamic table.  The 6-bit prefix integer (prefixed-integers) that
follows is used to locate the table entry for the field line.  When
T=1, the number represents the static table index; when T=0, the
number is the relative index of the entry in the dynamic table.
Paragraph (version B):
For example, with a Required Insert Count of 9, a decoder receives an
S bit of 1 and a Delta Base of 2.  This sets the Base to 6 and
enables post-base indexing for three entries.  In this example, a
relative index of 1 refers to the fifth entry that was added to the
table; a post-base index of 1 refers to the eighth entry.
Paragraph (version B):
An indexed field line representation identifies an entry in the
static table or an entry in the dynamic table with an absolute index
less than the value of the Base.
Paragraph (version B):
This representation starts with the '1' 1-bit pattern, followed by
the 'T' bit, indicating whether the reference is into the static or
dynamic table.  The 6-bit prefix integer (prefixed-integers) that
follows is used to locate the table entry for the field line.  When
T=1, the number represents the static table index; when T=0, the
number is the relative index of the entry in the dynamic table.
Paragraph (version A):
A literal field line with name reference representation encodes a
field line where the field name matches the field name of an entry in
the static table, or the field name of an entry in the dynamic table
with an absolute index less than the value of the Base.
Paragraph (version B):
A literal field line with name reference representation encodes a
field line where the field name matches the field name of an entry in
the static table or the field name of an entry in the dynamic table
with an absolute index less than the value of the Base.
Paragraph (version A):
This is possible even over the Transport Layer Security Protocol
(TLS, see TLS) and the QUIC Transport Protocol (see QUIC-TRANSPORT),
because while TLS and QUIC provide confidentiality protection for
content, they only provide a limited amount of protection for the
length of that content.
Paragraph (version B):
This is possible even over the Transport Layer Security Protocol
(TLS) and the QUIC Transport Protocol (QUIC-TRANSPORT), because while
TLS and QUIC provide confidentiality protection for content, they
only provide a limited amount of protection for the length of that
content.
Paragraph (version A):
QPACK mitigates but does not completely prevent attacks modeled on
CRIME (CRIME) by forcing a guess to match an entire field line,
rather than individual characters.  An attacker can only learn
whether a guess is correct or not, so is reduced to a brute force
guess for the field values associated with a given field name.
Paragraph (version A):
The viability of recovering specific field values therefore depends
on the entropy of values.  As a result, values with high entropy are
unlikely to be recovered successfully.  However, values with low
entropy remain vulnerable.
Paragraph (version B):
QPACK mitigates, but does not completely prevent, attacks modeled on
CRIME (CRIME) by forcing a guess to match an entire field line rather
than individual characters.  An attacker can only learn whether a
guess is correct or not, so the attacker is reduced to a brute-force
guess for the field values associated with a given field name.
Paragraph (version B):
Therefore, the viability of recovering specific field values depends
on the entropy of values.  As a result, values with high entropy are
unlikely to be recovered successfully.  However, values with low
entropy remain vulnerable.
Paragraph (version A):
Simply removing entries corresponding to the field from the
dynamic table can be ineffectual if the attacker has a reliable
way of causing values to be reinstalled.  For example, a request
to load an image in a web browser typically includes the Cookie
header field (a potentially highly valued target for this sort of
attack), and web sites can easily force an image to be loaded,
thereby refreshing the entry in the dynamic table.
Paragraph (version B):
Simply removing entries corresponding to the field from the
dynamic table can be ineffectual if the attacker has a reliable
way of causing values to be reinstalled.  For example, a request
to load an image in a web browser typically includes the Cookie
header field (a potentially highly valued target for this sort of
attack), and websites can easily force an image to be loaded,
thereby refreshing the entry in the dynamic table.
Paragraph (version A):
There is no currently known attack against a static Huffman encoding.
A study has shown that using a static Huffman encoding table created
an information leakage, however this same study concluded that an
attacker could not take advantage of this information leakage to
recover any meaningful amount of information (see PETAL).
Paragraph (version B):
There is no currently known attack against a static Huffman encoding.
A study has shown that using a static Huffman encoding table created
an information leakage; however, this same study concluded that an
attacker could not take advantage of this information leakage to
recover any meaningful amount of information (see PETAL).
Paragraph (version A):
A decoder can limit the amount of state memory used for blocked
streams by setting an appropriate value for the maximum number of
blocked streams.  In HTTP/3, this is realized by setting an
appropriate value for the SETTINGS_QPACK_BLOCKED_STREAMS parameter.
Streams which risk becoming blocked consume no additional state
memory on the encoder.
Paragraph (version B):
A decoder can limit the amount of state memory used for blocked
streams by setting an appropriate value for the maximum number of
blocked streams.  In HTTP/3, this is realized by setting an
appropriate value for the SETTINGS_QPACK_BLOCKED_STREAMS parameter.
Streams that risk becoming blocked consume no additional state memory
on the encoder.
Paragraph (version A):
If an implementation encounters a value larger than it is able to
decode, this MUST be treated as a stream error of type
QPACK_DECOMPRESSION_FAILED if on a request stream, or a connection
error of the appropriate type if on the encoder or decoder stream.
Paragraph (version B):
If an implementation encounters a value larger than it is able to
decode, this MUST be treated as a stream error of type
QPACK_DECOMPRESSION_FAILED if on a request stream or a connection
error of the appropriate type if on the encoder or decoder stream.
Paragraph (version A):
For fomatting reasons, the setting names here are abbreviated by
removing the 'SETTING_' prefix.
Paragraph (version A):
This document specifies two stream types.  The entries in the
following table are registered in the "HTTP/3 Stream Type" registry
established in HTTP3.
Paragraph (version B):
For formatting reasons, the setting names here are abbreviated by
removing the 'SETTINGS_' prefix.
Paragraph (version B):
This document specifies two stream types.  The entries in the
following table are registered in the "HTTP/3 Stream Types" registry
established in HTTP3.