Re: [TLS] Confirmation of Consensus on Removing Compression from TLS 1.3

> On Mar 26, 2014, at 18:02, mrex@sap.com (Martin Rex) wrote:
> 
> Paterson, Kenny wrote:
>> 
>> Really? I assume you know about CRIME??
> 
> Yes, I do.  Similar to BEAST, it is *NOT* an attack.
> It is a pretty boring demonstration of the principle of operation
> of querying an encryption oracle (BEAST) or compression oracle (CRIME).
> 
> None of the alleged "fixes" against BEAST and CRIME addresses the
> real vulnerability.  Even with compression disabled and TLSv1.1+ or
> AEAD cipher suites, the vulnerability is WIDE OPEN.  The attackers
> code could, rather than performing a demonstration of a boring
> principle, submit any attacker-desired nefarious request to the
> server, the Browser will blissfully insert the authentication-credentials
> into that nefarious request, and the server will blissfully execute
> the request.  

This is more an http issue than a tls issue but we pretty much have to go with the Web we have which includes (restricted) cross origin requests subject to the same origin policy.

EKR

> No matter what fancy stuff the TLS WG puts into TLSv1.3,
> the attack will continue to work as long as the browser keeps doing
> the stupid stuff: volutarily and blissfully inserting authentication
> credentials into requests that the browser performs on the attackers
> behalf.
> 
> 
> -Martin
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls