<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/04/2015 14:52, Salz, Rich wrote:<br>
</div>
<blockquote
cite="mid:4a138429210c497a931ea56ad8edfa69@ustx2ex-dag1mb2.msg.corp.akamai.com"
type="cite">
<pre wrap="">Jakob,
Thanks very much for the detailed response! I'm still not convinced that tls-layer compression is a good thing. You seem to be saying it could possibly be made to work, but ... do I have that view right?
</pre>
</blockquote>
<tt>I was merely trying to explain Thomas Tanner's suggestion<br>
for how to protect TLS compression against the (mostly<br>
HTTPS specific) attacks</tt><tt>.</tt><br>
<tt><br>
</tt><tt>However, as has been hinted at by others, TLS layer<br>
compression appears to be both useful and harmless for<br>
protocols that do not have the higher level properties that<br>
allow the CRIME/BREACH attacks. Specifically a small secret<br>
near a slightly longer chosen plaintext, surrounded by a lot<br>
of known plaintext, plus the ability to provoke a medium<br>
number of sessions each varying almost exclusively in the<br>
chosen plaintext.</tt><br>
<br>
<tt>It also appears the HTTP/2.0 draft aka SPDY requires<br>
compression</tt><tt> </tt><tt>to be enabled, though I don't know
if that<br>
is at the TLS or HTTP level.</tt><br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>