Re: [tcmtf] Security Threat: Compression Ratio Info-leak Made Easy (CRIME)

Hi, Martin.

I have been reading about the CRIME security exploit, but I think it only
affects if you compress the payload of the packet. What we are planning in
TCMTF is compressing headers in a certain network segment. After that, the
packet is rebuilt to its native form, so the packet arriving to the server
(or to the web browser) will have the same header it had when it was sent.
If you change the header, the packet does not arrive there.

Today we have discussed some security issues here. I hope we will send some
ideas to the list soon.

Thanks!

Jose

> -----Mensaje original-----
> De: tcmtf-bounces@ietf.org [mailto:tcmtf-bounces@ietf.org] En nombre de
> Martin Stiemerling
> Enviado el: jueves, 20 de junio de 2013 10:13
> Para: tcmtf@ietf.org
> Asunto: [tcmtf] Security Threat: Compression Ratio Info-leak Made Easy
> (CRIME)
> 
> Hi all,
> 
> My fellow Security AD just pointed me to the following security threat
that
> might also applicable in the case of tcmtf:
> Compression Ratio Info-leak Made Easy (CRIME), see [1].
> 
> Just to let you know for your considerations.
> 
>    Martin
> 
> [1] http://en.wikipedia.org/wiki/CRIME_%28security_exploit%29
> 
> 
> --
> martin.stiemerling@neclab.eu
> 
> NEC Laboratories Europe
> NEC Europe Limited
> Registered Office:
> Athene, Odyssey Business Park, West End  Road, London, HA4 6QE, GB
> Registered in England 2832014
> _______________________________________________
> tcmtf mailing list
> tcmtf@ietf.org
> https://www.ietf.org/mailman/listinfo/tcmtf