5 ms·
Yes, in other words compression can move information from the content of the data (which is encrypted) to the size of the data (which is not encrypted).
by DougBTX 10y ago
Yes, in other words compression can move information from the content of the data (which is encrypted) to the size of the data (which is not encrypted).
- hinkley 10y agoWhich is one of the selling points of block cyphers. They may not conceal the magnitude of the payload but they do obscure the exact byte count by rounding up. But that probably doesn't stop CRIME from being workable.
- angry_octet 10y agoHmm, I don't think it is really a selling point. A block cipher also implies needing a technique like CBC to prevent watermarking, and using CBC actually helps with oracle attacks. An interesting paper on using padding to obscure length: http://cihangir.forgottenlance.com/papers/lengthhiding-corrected.pdf http://cihangir.forgottenlance.com/papers/lengthhiding-corre...
- hinkley 10y agoOh, I'm a fan of prepadding, and there are other surveillance problems that TLS doesn't solve that are similar to the voice analysis attack. Web pages on a site have distinct patterns of load operations and I'm certain that if we haven't established how to profile a visitor by the pattern of packets that are sent and received, that it's only a matter of time until we do.