Subject: [Cfrg] TLV vs Compression

From: James Cloos <[email-masked]>
Date: Fri, 11 Jul 2014 21:36:53 -0400

My understanding is that tls with compression is vulnerable due to
allowing unauthenticated initiators, which permits an oracle attack.

If so, does it follow that a tls-like protocol, which enables
compression only when symetric key negotiation uses temporal secrets
(ie, the pfs concept), when mutual authentication is done, and only for
application-level data, would be safe from compression-specific attacks?

Or posed differently, if an application knows that the tls socket uses
pfs and is mutually authenticated, is it ever safe for *it* to compress
the data it sends over said socket?

And for sockets which are only half-authenticated, can it be secure for
the side which authenticated its peer to compress its own outgoing data?

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6