Re: [TLS] TLS 1.3 - Support for compression to be removed

[Martin Thomson <[e-mail]>]

On 4 October 2015 at 19:26, Eric Rescorla <[e-mail]> wrote:
> Consider the trivial case of ASCII text. Each character takes up the
> same amount of room, but if you compress (as an intuition pump,
> think of a simple Huffman code), then more common characters
> take up less room than less common characters.

This is right, but it's also not the case that revealing information
like that is necessarily bad.  Perhaps it isn't that interesting to an
adversary that they can learn that there is (for example) English text
being exchanged.  That wouldn't be particularly relevant in helping
them distinguish between ciphertext that contains interesting text
from ciphertext containing uninteresting text.

HPACK for instance compresses base64-encoded data unevenly.  But the
study that was run in 2013 determined that it wasn't especially
interesting. [32] shows ~2 bits regained from a 30 character word.  Of
course, you should examine the conditions on that claim; such a result
is not generally applicable.  Mixing attacker-controlled data with
secrets has shown to make protecting those secrets extremely
difficult.

[32] http://pdl.cmu.edu/PDL-FTP/associated/CMU-PDL-13-106.pdf