News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?.

Re:Google disables compression for OpenSSL in Chrome - SSL e... by sanxiyn on Wednesday September 12, 2012 @11:43AM (#4511160)
man sshd_config.

Compression: Specifies whether compression is allowed, or delayed until the user has authenticated successfully. The argument must be "yes", "delayed", or "no". The default is "delayed".

I don't know why they chose "delayed" as default, but this seems to prevent this attack.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by tptacek on Wednesday September 12, 2012 @11:51AM (#4511214)
The SSH protocol is nothing like TLS. The SSH security model is nothing like the TLS security model. Pornin's guess about Thai and Juliano's attack does not break the TLS authentication model; it breaks the confidentiality guarantees TLS makes to the application layer. If you authenticated TLS with certificates the way SSH authenticates with keys, you wouldn't worry about the compression attack.

So, not so much.

[ Parent | on HN ]