News for hackers. Stuff that matters.
Re:Google disables compression for OpenSSL in Chrome - SSL e... by tptacek on Wednesday September 12, 2012 @11:36AM (#4511127)
The attack as described by Thomas Pornin is indeed specific to HTTPS. Generalize it past HTTPS and its elements are:

1. Attacker controls some parts of plaintext

2. Attacker's content is mixed with content attacker wants to discover

3. Attacker can make repeated trials against the same plaintext (not against same ciphertext stream or key)

4. Defender compresses content on the fly

There are probably other cryptosystems that have this flaw, but it's less inherent to TLS than it is to the HTTPS security model.

There are no comments on this comment yet.