Re: bohe and delta experimentation...

[Roberto Peon <[e-mail]>]

Heh. We have more information about what is safe and what is not safe than
that!

Things we have fairly high confidence about w.r.t. CRIME:
  Partial-text matches are unsafe for any potentially sensitive field.
  Full-atom matches are safe for any field, including those with
potentially sensitive information.
  Dynamic entropy-coding, where the code-tables change based on input is
unsafe
  Static entropy-coding, where the code-tables have no relation to user
input is safe.

-=R


On Fri, Jan 18, 2013 at 10:18 AM, Willy Tarreau <[e-mail]> wrote:

> Hi Roberto,
>
> On Fri, Jan 18, 2013 at 09:22:11AM -0800, Roberto Peon wrote:
> > This makes URLs vulnerable to the CRIME attack, and URLs definitely do
> > contain sensitive information often :(
> >
> > This is true for anything which allows partial matches (I just can't
> figure
> > out how date could be sensitive, but if it could, even the encoding
> > suggested earlier by me would be dangerous).
> >
> > I dropped exactly this (prefix match) functionality from delta early on
> > because of this.
>
> If we consider that anything is sensible to the CRIME attack, then we need
> to go fully stateless I guess, otherwise it will be too hard to find out
> what is safe to reuse and what is risky :-/
>
> Willy
>
>