Re: [TLS] Confirmation of Consensus on Removing Compression from TLS 1.3

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 26 March 2014 18:42:51 GMT+00:00, "Joseph Salowey (jsalowey)" <[e-mail]> wrote:
>The consensus in the room at IETF-89 was to remove compression from TLS 1.3
>to remove this attack vector.

+1 Remove compression.

Compression is usually best performed as "high" as possible; transport layer is blind to what's being compressed, which is (as we now know) was definitely too low and was in retrospect a mistake.

Any application layer protocol needs to know - if compression is supported - to separate compression contexts for attacker-chosen plaintext and attacker-sought unknown secrets. (As others have stated, HTTPbis covers this.)

Any encrypted (or unencrypted) protocol could potentially have a size oracle where compression dictionaries were mixed in that case. That's an issue for the security of the underlying protocol, although I think we should draw strong attention to it and remind implementers that we cannot protect from that (and make no attempt to protect from size oracles in TLS in general).

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJTNBuJGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t66sQP/05Ap4HkgyvUlxuiMWWs2D5MOJT5sXZnd4WYRDML/JpPzKG8GSeQ
NIga9dxXa3mpdaW++9xM/KZs+4SH0XvwURsTMapbCPeFCwdSknHvVVD2bC1thKY+
quzeiuNj3I3DGZ6vccgspgzTEePylxDtAU+YP+2+fvYy/Vlsb15OsOw4oIFG9et5
kwY6kJpFGsZpURElJE/zAEOKB8GwXAGJ/4r+gnPmXpP7e9jJxqC0fsLjhwnlx4o4
IR6+gjZ1LYPGswCjfj8kLxNByTE0fCzlg9yGzPkOLUscSQFytGE0TVbivvAKWv6y
SPVdlxlKb9NEZPbL6bCBXrj328YbncwJ3sxcMfxxx/mS50ZUSP/USFX7ss1L3wW5
Yr90LjG/O9opAz/xqnX/qTnOBpTENNUu0ZR7Hd0Ha3Nw2BWIqy8jhN6bvK8CWAiN
jS2LZSgy8MDfkfjUAAAFX0MDrVTLlt4GKUEj07TtNVOnV2YtdBZy0u76sQ2hes8c
V1SNNchJQTldkMjii8IWTo6L4JTGM9zQfaThXIMkUJrNWyvxN9CCJ7WCYA/wHICb
Q6oo+j6hMrV653B7NfsD5JaD9mHovkzU2iOVwDZXI6iMvjHsXTWOCB2f10TTKXSk
SXzpROPLvM7ZemVKdbmptFJecUNuFqLD4/BY6vBLLM+ZYBSMOAx3AOjY
=l/mz
-----END PGP SIGNATURE-----