Computer Science > Cryptography and Security
[Submitted on 3 Jul 2017]
Title:Effect of Pipelining and Multiplexing in Estimating HTTP/2.0 Web Object Sizes
View PDFAbstract:HTTP response size is a well-known side channel attack. With the deployment of HTTP/2.0, response size estimation attacks are generally dismissed with the argument that pipelining and response multiplexing prevent eavesdroppers from finding out response sizes. Yet the impact that pipelining and response multiplexing actually have in estimating HTTP response sizes has not been adequately investigated. In this paper we set out to help understand the effect of pipelining and response multiplexing in estimating the size of web objects on the Internet. We conduct an experiment that collects HTTP response sizes and TLS record sizes from 10k popular web sites. We gather evidence on and discuss reasons for the limited amount of pipelining and response multiplexing used on the Internet today: only 29% of the HTTP2 web objects we observe are pipelined and only 5% multiplexed. We also provide worst case results under different attack assumptions and show how effective a simple model for estimating response sizes from TLS record sizes can be. Our conclusion is that pipelining and especially response multiplexing can yield, as expected, a perceivable increase in relative object size estimation error yet the limited extent of multiplexing observed on the Internet today and the relative simplicity of attacks to the current pipelining mechanisms hinder their ability to help prevent web object size estimation.
References & Citations
Bibliographic and Citation Tools
Bibliographic Explorer (What is the Explorer?)
Litmaps (What is Litmaps?)
scite Smart Citations (What are Smart Citations?)
Code, Data and Media Associated with this Article
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub (What is DagsHub?)
Gotit.pub (What is GotitPub?)
Papers with Code (What is Papers with Code?)
ScienceCast (What is ScienceCast?)
Demos
Recommenders and Search Tools
Influence Flower (What are Influence Flowers?)
Connected Papers (What is Connected Papers?)
CORE Recommender (What is CORE?)
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.