Re: [TLS] TLS 1.3 - Support for compression to be removed

[Dave Garrett <[e-mail]>]

On Sunday, October 04, 2015 02:09:49 pm Tony Arcieri wrote:
> If someone has produced a secure system for "compression side-channel
> resistant encryption", I haven't seen it.

I can think of a way to do this, but the people who want compression badly probably won't like it due to the need to pad heavily.

1) Pick a fixed bandwidth
2) Compress & encrypt the stream
3) Send the compressed stream at a rate blocked to the cap
4) Whenever below the cap, pad the stream to the cap

Maintain a fixed transmission of data per unit time and there's no way to tell the size of anything (even if delivery doesn't match the rate). However, this relies on being able to pick a usable fixed bandwidth (in each direction). The bandwidth cap size and length of transmission times still gives quite a bit of info, e.g. 1GB vs 1KB total is quite telling, but that's true without compression.

With a good compression algorithm, the above could probably produce an overall more efficient stream rather easily for many things. If your idea of compression is to keep using DEFLATE forever, however, you should probably just reevaluate what you're doing.


Dave