3 ms·
>(there's a limited combination of packages that sum up to that number). That is a really hard problem to solve. See the knapsack problem. Imagine I downloade
by zaarn 8y ago
>(there's a limited combination of packages that sum up to that number).
That is a really hard problem to solve. See the knapsack problem.
Imagine I downloaded 5 packages. Debian has about 68'000 packages. That means there is a total of 1 septillion combinations.
If you could check 1 trillion package combinations per second, it would only take 20 thousand years to solve (40 thousand worst case).
- yc12340 8y agoYou are assuming, that all packages are equally interesting (and your math does not account for package dependencies). In practice, attacker either does not care about your packages, in which case hiding that information gains you nothing, or wants to be alerted, when you (or anybody else) install one of few specific packages. Those combinations can be computed in advance and identified in traffic.
- zaarn 8y agoNot necessarily, I think you underestimate the complexity of this attack. Even if you were interested in a few packages, if any additional packages are mixed in or if dependencies are already installed, this problems become a lot harder again. While HTTPS doesn't make such an "attack" impossible, it makes it very hard and compared to HTTP the attacker cannot inject or replace data (replay attacks are possible with APT on plain HTTP)