http2/http2-spec — pull request #517 by martinthomson (2014-06-11 00:06:21+00:00)
Title: HPACK Security Considerations

I have written what I think is a slightly more robust Security Consideration for HPACK. This covers:
* the attack in the general sense,
* how the attack might apply in HPACK and HTTP,
* particular areas of concern,
* how HPACK inherently mitigates these attacks,
* what environments might need additional mitigation, and
* some suggested mitigation strategies.

Mitigation strategies that I have described are:
* actor-based isolation (a generalized application of the origin isolation principle)
* destroy values on failed guesses (thanks here to Adam Barth for the idea), either probabilistically, or based on a count, with a recommendation that shorter values be made harder to guess
* specific protection for "special" header fields

There are a few formatting changes in the first commit, sorry.