[saag] Considerations for Protocols with Compression over TLS
"KIHARA, Boku" <bkihara.l@gmail.com> Tue, 23 October 2012 14:29 UTC
Return-Path: <bkihara.l@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D05EC21F8504; Tue, 23 Oct 2012 07:29:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.164
X-Spam-Level:
X-Spam-Status: No, score=-3.164 tagged_above=-999 required=5 tests=[AWL=0.435, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gXqPB4qtQrSs; Tue, 23 Oct 2012 07:29:14 -0700 (PDT)
Received: from mail-vb0-f44.google.com (mail-vb0-f44.google.com [209.85.212.44]) by ietfa.amsl.com (Postfix) with ESMTP id 299E121F84F5; Tue, 23 Oct 2012 07:29:13 -0700 (PDT)
Received: by mail-vb0-f44.google.com with SMTP id fc26so4730212vbb.31 for <multiple recipients>; Tue, 23 Oct 2012 07:29:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=PCaES+dDQ1h6RuLoLN35zgu89YJhxH4Fjb9hMFONA70=; b=lZpHxTHOvyZmMFTHdpW4LUlUhXNEVQ3wwG7kTqvc68i1BVCp5gveepu/e0/FLRH3xp zCKwyzsCIYEtdfEJIxi+Jrzo4poJ9Fa7pdfHdIZf0GJhuFllTVvhFMpSs5PCGk0h3IiA GKtROBmw2UYsoI5cH5JW3ZbwV8PAZiRbsVzRs2HpP9pzPF8LQohE5l/GRxytn7ynkXWl ZGJ8KGncOl+pCzcqfsvgIB0xEMh1L/T5zTP1yJaxy+1/17Z59D/6WMsGq/wImEnfOmhf gOV7zgKJhog2Y/0MnUHHAVvihdgzQ7SCKJJCCQx6Ydjn5Yh0chO7/MTCvawoYd5YEOPx z0xA==
MIME-Version: 1.0
Received: by 10.52.22.72 with SMTP id b8mr16893649vdf.88.1351002553111; Tue, 23 Oct 2012 07:29:13 -0700 (PDT)
Received: by 10.58.221.33 with HTTP; Tue, 23 Oct 2012 07:29:13 -0700 (PDT)
Date: Tue, 23 Oct 2012 23:29:13 +0900
Message-ID: <CAM+81qK=t03UhYvU4KYhzQtQrGwQhmVDoKut5MLeEN_yn-VPcw@mail.gmail.com>
From: "KIHARA, Boku" <bkihara.l@gmail.com>
To: apps-discuss@ietf.org, saag@ietf.org
Content-Type: text/plain; charset="ISO-8859-1"
Subject: [saag] Considerations for Protocols with Compression over TLS
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/saag>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Oct 2012 14:29:14 -0000
Hello, I'm writing a draft on cosiderations for protocols with compression over TLS, since I was shocked by the CRIME attack. http://tools.ietf.org/html/draft-kihara-compression-considered-harmful-01 What I want to say are: * the CRIME attack may be applied if compression is applied in any form * disabling TLS Compression and SPDY header compression is not a perfect solution; the threat has not gone! * there should be some mitigations to take when using compression in TLS Because I am neither a cryptographer nor a security expert there must many mistakes in the draft in addition to language faults, but I think it is good that we have some guides for comression in TLS. Is IETF the write place to do such things? Regards, Boku Kihara.
- [saag] Considerations for Protocols with Compress… KIHARA, Boku