Subject: Re: draft-ietf-httpbis-http2-latest, 4.3 Header Compression and Decompression, 10.6 Use of Compression

From: Martin Thomson <[email-masked]>
Date: Wed, 9 Jul 2014 11:37:04 -0700

On 8 July 2014 22:23, Kari Hurtta <[email-masked]> wrote:
> Or is that "MUST NOT compress content" too strong language?

Not really.  In the proxy deployment case, the proxy is obligated to
either understand the content and context, or to avoid using
compression.

In reality, I think people will ignore the advice and open themselves
to the sorts of attack you describe.

---

From: Martin Thomson <[email-masked]>
Date: Wed, 9 Jul 2014 21:44:22 -0700

On 9 July 2014 20:47, Kari Hurtta <[email-masked]> wrote:
>
> 1) Attack is relevent only when TLS is used -- otherwise data
>    is observed by attacker in any case
>
> 2) TLS between proxy -> Web server   means that
>    original URL was  https://...
>
> 3) https://... URL means that T wants end to end encryption
>    and therefore T uses CONNECT methed for proxy

These are correct, but we are talking about new uses for TLS, and
there are cases (gateways in particular) where the problem could
manifest.