4 ms·
The rule is: never compress something secret together with something potentially attacker-influenced. If the attacker can influence the traffic, they can poten
by api 10y ago
The rule is: never compress something secret together with something potentially attacker-influenced.
If the attacker can influence the traffic, they can potentially gather information about the secret by examining the effect of differing traffic patterns on the size of the encrypted result.
- TorKlingberg 10y agoNo, the rule is: never compress something secret together with something potentially attacker-influenced, at least if the length of the compressed data leaks.
- api 10y agoFixed. That was a typo/thinko.
- deleted 10y ago[deleted]
- AgentME 10y agoThat's an excellent rule, but that doesn't cover the other example used about voice communications.