RFC 7541 Quiz

**Explanation:** **Terms:** header compression, static table, dynamic table, indexing **Correct (B):** HPACK compresses header fields, often by referring to entries in a static or dynamic table **Options:** - A (incorrect): Encryption is provided by TLS, not HPACK - B (correct): This is the core design goal - C (incorrect): Authenticity is not guaranteed by HPACK **Related:** HTTP/3 uses QPACK instead of HPACK because transport properties differ

**Explanation:** **Terms:** dynamic table, connection state **Correct (C):** The dynamic table is updated by header blocks as requests and responses flow **Options:** - A (incorrect): The static table is fixed by the specification - B (incorrect): Unrelated to HPACK - C (correct): The dynamic table evolves per connection **Related:** Wrong dynamic table state leads to decompression failures and protocol errors

**Explanation:** **Terms:** sensitive header field, never indexed, side channel **Correct (A,C,D):** Credentials and session identifiers are high value targets and can amplify compression side channels **Options:** - A (correct): Often contains secrets - B (incorrect): Usually low sensitivity - C (correct): Often contains session identifiers - D (correct): Often sets session identifiers **Related:** Compression plus attacker influence can leak information, so treat secrets carefully

**Explanation:** **Terms:** SETTINGS, dynamic table size **Correct (A):** Peers advertise limits and the encoder must respect them **Options:** - A (correct): This prevents unbounded memory usage - B (incorrect): Unrelated - C (incorrect): Unrelated **Related:** Encoders can also send dynamic table size updates within header blocks

**Explanation:** **Terms:** Huffman coding **Correct:** Huffman **Related:** HPACK defines a specific Huffman code table for efficiency

**Explanation:** **Terms:** compression side channel, attacker chosen input **Correct (C):** Size and compression ratio can leak information about secrets in some threat models **Options:** - A (incorrect): Unrelated - B (incorrect): TLS authentication is separate - C (correct): This is a known category of risk **Related:** Treat cookies and credentials as sensitive and consider never indexed encodings