3 ms·

Absolutely incredible. I had no idea this was even possible. Defeating CRIME while keeping compression? I can hardly believe it.

• amluto 11y ago
  AFAICT this only avoids CRIME if there's never both attacker-controlled data and a secret in the same SLZ compress call.
  • bonyt 11y ago
    But I think the idea is that the compress call takes such a small amount of data that it is far less likely for there to be such data in the same call
    • mikeash 11y ago
      It goes beyond that, and suggests explicitly dividing up the data into sensitive and potentially attacker-controlled pieces, and processing those pieces separately. In short (and I could be wrong, but this seems to be the basic idea), if you always start a new chunk after you're done sending headers and before you start sending content, you're safe.
  • striking 11y ago
    You can separate the calls while keeping the streams intact.