Subject: [TLS] TLS 1.3 - Just ditch compression

From: Scott Arciszewski <[email-masked]>
Date: Fri, 09 Oct 2015 02:12:51 -0000

Based on CRIME and BREACH we know that this construction is not secure:

C = encrypt(compress(A || B))

If you control B and A contains sensitive information, strlen(C) tells you
information about A. Vice versa if you control A and B contains sensitive
information.

In the context of a web application, this can lead to the compromise the
contents of HTTP-Only cookies.

This is known to be safe: C = encrypt(A || B). (No compression.)

This might be safe: C = encrypt(A || compress(B) ).

If an application needs to compress data before encryption, it shouldn't be
a Transport Layer protocol's job to do so.

Compression has no place in Transport Layer Security. Please nix it until
we can, in a provably secure manner, make C = encrypt(compress(A || B)) not
leak information about A when an attacker controls B.

I await your IACR papers that prove the contrary, or a swift and decisive
vote to kill TLS encryption in 1.3. Further bikeshedding is just
embarrassing.

Just my $0.02.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

---

From: Russ Housley <[email-masked]>
Date: Sun, 1 Nov 2015 19:53:50 -0500

I thought we already decided to remove compression from TLS 1.3.

Russ

On Oct 8, 2015, at 10:10 PM, Scott Arciszewski wrote:

> If you control B and A contains sensitive information, strlen(C) tells you information about A. Vice versa if you control A and B contains sensitive information.
> 
> In the context of a web application, this can lead to the compromise the contents of HTTP-Only cookies.
> 
> If an application needs to compress data before encryption, it shouldn't be a Transport Layer protocol's job to do so.
> 
> Compression has no place in Transport Layer Security. Please nix it until we can, in a provably secure manner, make C = encrypt(compress(A || B)) not leak information about A when an attacker controls B.
> 
> I await your IACR papers that prove the contrary, or a swift and decisive vote to kill TLS encryption in 1.3. Further bikeshedding is just embarrassing.
> 
> Just my $0.02.
> 
> Scott Arciszewski
> Paragon Initiative Enterprises

---

From: Dave Garrett <[email-masked]>
Date: Sun, 1 Nov 2015 20:01:48 -0500

> I thought we already decided to remove compression from TLS 1.3.

We did.

See here:
https://www.ietf.org/mail-archive/web/tls/current/msg17941.html

On Thursday, October 08, 2015 10:10:51 pm Scott Arciszewski wrote:
> Compression has no place in Transport Layer Security.
[...]
> Further bikeshedding is just embarrassing.

The bikeshed was officially demolished. Compression will not be in TLS 1.3.

Dave

---

From: Sean Turner <[email-masked]>
Date: Mon, 2 Nov 2015 10:13:38 +0900

My bad there were some messages sitting in the moderator queue that I let go.

spt

> On Nov 02, 2015, at 10:01, Dave Garrett <[email-masked]> wrote:
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls