Re: [TLS] TLS 1.3 - Support for compression to be removed

[Watson Ladd <[e-mail]>]

On Tue, Sep 22, 2015 at 2:56 PM, Jeffrey Walton <[e-mail]> wrote:
> On Tue, Sep 22, 2015 at 2:40 PM, Salz, Rich <[e-mail]> wrote:
>> The security community thinks that compression is risky, error-prone, and that a security/auth layer is the wrong place to put it.
>>
>> So far, the only counter-argument has been "if TLS 1.2 has a flaw, I want to move to TLS 1.3 without losing data compression."
>>
>> Is this accurate?
>
> TLS lacks a clear list of goals and objectives, so its makes things
> harder and reduces some of the arguments to the favorite color of the
> bikeshed.
>
> If compression increases entropy, then one could argue its a desired
> service with security benefits.

One could. Or one could realize that for the past ~30 years, we've
understood "security" as a question about ideal vs. real
functionality, or adversarial advantage in games, and note instantly
that compression breaks every definition in the literature of secure
encryption. One could change the security notions accordingly, but
that complicates the guaranties made to higher levels.

> Is all compression risky, or just DEFLATE? If compression is a benefit
> and DEFLATE is risky, then maybe a new compression method needs to be
> offered.
>
> Call out the goals and objectives, and most of the speculation about
> what to do with it should go away. You will either find authority, or
> you will lack authority, to provide it.
>
> Jeff
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.