SSL, Gone in 30 seconds

Re:SSL, Gone in 30 seconds by laumars on Friday August 02, 2013 @09:26AM (#6146728)

Disabling compression is at the server level rather than code level (and it's a real easy config change too). However I can see that being an unfavourable solution for some of the busier sites.

[ Parent | on HN ]

Re:SSL, Gone in 30 seconds by cryptic on Friday August 02, 2013 @11:04AM (#6147334)

Adding a few random bytes to a response seems to be an easy fix and doesn't require compression being disabled.

[ Parent | on HN ]

Re:SSL, Gone in 30 seconds by jmillikin on Friday August 02, 2013 @11:07AM (#6147362)

Adding a random amount of random bytes will not defeat the attack, it would only slightly increase the amount of time required by making the side channel noisier.

Adding a fixed amount of random bytes will have no benefit at all.

[ Parent | on HN ]

Re:SSL, Gone in 30 seconds by quizotic on Friday August 02, 2013 @03:36PM (#6149158)

Not following your assertion. Suppose the reported size was always a random epsilon larger than the actual size. Choose epsilon so that its small enough to benefit from compression and large enough to obscure the BREACH. Why doesn't that work?

[ Parent | on HN ]

Re:SSL, Gone in 30 seconds by beagle3 on Friday August 02, 2013 @03:06PM (#6148952)

Can you quantify "slightly"?

[ Parent | on HN ]