IETF Logo Mail Archive

Re: [TLS] TLS 1.3 - Support for compression to be removed

Dave Garrett <davemgarrett@gmail.com> Sun, 04 October 2015 18:32 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F6961B3489 for <tls@ietfa.amsl.com>; Sun, 4 Oct 2015 11:32:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TEBvWUJVH0xe for <tls@ietfa.amsl.com>; Sun, 4 Oct 2015 11:32:38 -0700 (PDT)
Received: from mail-qg0-x232.google.com (mail-qg0-x232.google.com [IPv6:2607:f8b0:400d:c04::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 698521B3487 for <tls@ietf.org>; Sun, 4 Oct 2015 11:32:38 -0700 (PDT)
Received: by qgez77 with SMTP id z77so133237437qge.1 for <tls@ietf.org>; Sun, 04 Oct 2015 11:32:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=fVBq6Y4MLcn5am1mCIdRRWP9aQ10xWAyTl+OKgmNF0s=; b=FS/QoFZCSltGt6m1DxgAv3HsrlO2yJF9U5GxUEowhEgkJrnYNP/YW5Ap7bA3Q4jOX1 59ZElFwYHfa8tHdp5fYCiHh0zKVRHmgV/YELbo/ao9hh5diPPRgYI4cSChmVNfG5vB9o F6g8RBjUvbWU4+hGH6BUGuIAijNlDdwL90bi0ouAl1/QDJZOqIo8zZrdHgtPtD9EdYM4 pBtkVtDJru68wFseX4oj7AOArp+Ia8uMXiWQHlj/nMemzMhcuTvf8sKKjyRtqMY5MvUz vN/l7xaSp4Y3Ot9gWRH9Q564rupsYZzIJlZ/d/zrypKrKko/4sXEXfbVs4TCEZATJUg/ kkww==
X-Received: by 10.140.19.175 with SMTP id 44mr33545299qgh.50.1443983557469; Sun, 04 Oct 2015 11:32:37 -0700 (PDT)
Received: from dave-laptop.localnet (pool-72-94-152-197.phlapa.fios.verizon.net. [72.94.152.197]) by smtp.gmail.com with ESMTPSA id c7sm9501262qgc.2.2015.10.04.11.32.36 (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 04 Oct 2015 11:32:36 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: tls@ietf.org, noloader@gmail.com
Date: Sun, 04 Oct 2015 14:32:35 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <79C632BCF9D17346A0D3285990FDB01AA3B9DAD8@HOBEX21.hob.de> <CAHOTMVL+C4Q2=wAVMWmSbyzmmZb7o6pucN=bEKv70eq8wWLA_w@mail.gmail.com> <CAH8yC8nRoAk1KxQRKp3Yr8y8Yut3hc5pOgJ-hqShO3qb6cg2wQ@mail.gmail.com>
In-Reply-To: <CAH8yC8nRoAk1KxQRKp3Yr8y8Yut3hc5pOgJ-hqShO3qb6cg2wQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201510041432.35903.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/zR_SujUSpAi81qvG_Eu6gbpGfmU>
Subject: Re: [TLS] TLS 1.3 - Support for compression to be removed
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 04 Oct 2015 18:32:39 -0000

On Sunday, October 04, 2015 01:58:09 pm Jeffrey Walton wrote:
> Is that necessarily true?

It should be apparent by now that the dominant opinion is that compression in TLS is not worth the risk and not worth the time to attempt to deal with here. Whether or not a generic compression algorithm could theoretically be made safe is irrelevant at this point. It's a known-dangerous attack surface that we don't want the risk of.


Dave

v2.23.0 | Report a Bug | By Email