Subject: HTTP/2 and HTTPS BICYCLE attack

From: "Smith, Kevin, (R&D) Vodafone Group" <[email-masked]>
Date: Thu, 7 Jan 2016 10:03:31 +0000

Hi all,

Just seen the 'HTTPS BICYCLE attack' study [1], which claims that 'the redundancy of the plaintext HTTP headers included in each and 
every request can be exploited in order to reveal the length of particular components (such as passwords) of particular requests'  

Although I've not seen any further analysis to verify the study, would it be correct to think that HTTP/2's support of sending only header deltas would mitigate such an attack?

Many thanks,
Kevin

[1] https://guidovranken.files.wordpress.com/2015/12/https-bicycle-attack.pdf

---

From: "Smith, Kevin, (R&D) Vodafone Group" <[email-masked]>
Date: Thu, 7 Jan 2016 11:53:07 +0000

> I wouldn't prepare for the apocalypse over this.  

I'll turn the kettle off then :)

> It reveals the length of fields that are unknown in the presence of known or predictable information.  It doesn't actually reveal the bytes, just the length.  Then they are left with the actually hard problem of extracting the actual value of the characters.

Would knowing which passwords are feasible to brute-force due to short length be an advantage to an attacker though...?

Cheers,
Kevin

---

From: Martin Thomson <[email-masked]>
Date: Thu, 7 Jan 2016 22:34:03 +1100

I wouldn't prepare for the apocalypse over this.  It reveals the
length of fields that are unknown in the presence of known or
predictable information.  It doesn't actually reveal the bytes, just
the length.  Then they are left with the actually hard problem of
extracting the actual value of the characters.

Note that HTTP/2 isn't strictly better than HTTP/1.x when it comes to
lengths.  The point this work is that there is a predictable component
and a non-predictable one.  HTTP/2 only makes it a little harder to
predict the predictable part.  Huffman coding might throw in some
noise, as might header compression, but I don't think that would be a
significant barrier to a serious attacker (such as a researcher
looking for more funding).

If this had come with actual password recovery, I'd be impressed, but
we've known for a long time that TLS doesn't protect lengths. TLS 1.3
will let you try to protect lengths, but it's hard enough to do that
we will likely give the same advice there: if you have a secret, then
make it long, make every bit hard to guess, and make it the same
length as all the other things like it.

---

From: Ilari Liusvaara <[email-masked]>
Date: Thu, 7 Jan 2016 15:50:56 +0200

> length as all the other things like it.

HTTP/2 has padding support too (at least for HEADERS and DATA), right?

(Of course, this doesn't make it easy to use).

-Ilari

---

From: Martin Thomson <[email-masked]>
Date: Fri, 8 Jan 2016 08:34:22 +1100

> HTTP/2 has padding support too (at least for HEADERS and DATA), right?

Yes, but no one is using it to mitigate this sort of length recovery.
At least as far as I know.