Re: [secdir] Secdir review of draft-murchison-nntp-compress-05

[Barry Leiba <[e-mail]>]

I've been thinking on this since you mentioned it, and I have mixed
feelings.  So let me spread them out here:

On the one hand, it's well known that poorly implemented compression
has a lot of potential for problems of various kinds, including
security.  You're basically considering saying that, and saying that
it's therefore important to implement the algorithms correctly.  Well,
yes.

On the other hand, there *is* this particular issue that we know can
be a sticky point, so... why not mention it?  Kind of saying that you
have to implement the algorithms correctly, and that you should be
particularly careful about buffer sizes when deflating because just a
few bytes can deflate into unexpectedly huge results, and that's often
used to attempt attacks.

And on the third hand (I'm Martian), text is cheap, and if a few words
can be helpful, that seems reasonable.

On the fourth hand (and that's all that Martians have), it's not this
document's job to cover security (or other) issues in the compression
algorithms themselves.

So, yes: in the end, I think it's worth putting in a few words about
this, just to be clear that it's a common trap.

Barry


On Mon, Oct 3, 2016 at 4:47 PM, Julien ÉLIE <[e-mail]> wrote:
> Hi Barry,
>
> I'm currently reviewing the comments I need to take into account for the
> document.
> Do you believe I should add a note about a possible security issue as far as
> the use of DEFLATE is concerned?  (see below)
> (An "out of memory" attack?)
>
> Thanks,
>
> --
> Julien
>
>
> Le 22/09/2016 à 22:52, Julien ÉLIE a écrit :
>>
>> Hi Barry,
>>
>> Thanks for your answer.  I'll have a deeper look at it soon.
>>
>> As for the remaining "small points" of rewording (SHOULD, MUST, etc.),
>> I'll calmly see them when updating the draft after Last Call.  In case I
>> have a doubt for the best wording, I'll ask Ken (co-author) and Michael
>> (write-up shepherd) their preference.  We'll obviously manage to come up
>> with the "final" rewording as we'll have 3 votes for 2 choices.
>>
>>
>> Now that I think about it, wouldn't it be worth adding something about
>> possible "out of memory" attacks in the Security Considerations Section?
>>
>> According to <http://zlib.net/zlib_tech.html>, "a 50MB file filled with
>> zeros [...] a version of run-length encoding optimized for this sort of
>> unusual data file [...] could encode the test file in five bytes. That
>> would be a compression factor of 10,000,000:1".
>> So sending just 5 bytes may require an expansion to 50MB.
>>
>> Implementations therefore really need to check that the uncompressed
>> data does not exceed an upper bound limit.
>>
>> RFC 1951 (DEFLATE) does not mention it in its Security Considerations,
>> and I don't remember having seen that in other RFCs too.  Maybe we
>> should say a word for it in the NNTP COMPRESS extension.
>>
>