Re: [TLS] Confirmation of Consensus on Removing Compression from TLS 1.3

I think this would be a mistake. I would recommend instead to say that 
compression SHOULD be disabled by default. But leave the option in the 
protocol for applications that need compression and are able to mitigate 
the vulnerability. This does NOT include normal Web traffic.

The reason is that we have compression at the HTTP layer too, it is 
widely used, and is subject to similar vulnerabilities when run over 
TLS. AFAIK, no-one is proposing to ban HTTP compression [1]. So we're 
just moving the problem to a different protocol layer, one that may be 
less security conscious.

And in general, an encrypted transport should provide compression as one 
of its services. Architecturally this is the right level, which is why 
it was put there in the first place.

Thanks,
	Yaron

[1] http://http2.github.io/http2-spec/index.html#rfc.section.10.6

On 03/26/2014 08:42 PM, Joseph Salowey (jsalowey) wrote:
> The use of compression within TLS has resulted in vulnerabilities that can be exploited to disclose TLS encrypted application data.   The consensus in the room at IETF-89 was to remove compression from TLS 1.3 to remove this attack vector.  If you have concerns about this decision please respond on the TLS list by April 11, 2014.
>
> Thanks,
>
> Joe
> [Speaking for the TLS chairs]
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>