Re: [TLS] TLS 1.3 - Support for compression to be removed

[Jeffrey Walton <[e-mail]>]

> IMHO, compression adds too many security vulnerabilities to a general
> purpose secure communication protocol. I think TLS 1.3 is right in
> eliminating it. It is too big a foot gun.

To play devil's advocate: if (1) compression increases attack surface
and (2) people use compression, then wouldn't the best place to
address it be in a protocol or security library rather than pushing it
into a higher level in the stack where it likely won't be addressed?

> I do have a lot of sympathy with those who have been using compression in
> previous versions of TLS. Probably the best solution for them is to have a
> TLS like library which only does compression. It could be largely API
> compatible so switching between TLS and compression is a relatively easy
> programming job. I'll let the TLS implementers say just how hard such a
> library would be to produce.

OpenSSL currently has an configuration option to build without
compression methods (no-comp). I usually build OpenSSL without
compression, and OWASP recommends building without compression
(https://www.owasp.org/index.php/C-Based_Toolchain_Hardening).

Building without compression is my personal preference, but I would
not go so far to say others should not do it because that reduces to
bike shedding. It would be like me saying, ADH and ECADH should be
removed because they don't provide any real security. Or, me saying
PKIX should be removed because the IETF provides Public Key Pinning
with Overrides, which does not provide any real real security.

Jeff