Re:SSL, Gone in 30 seconds
by jmillikin on Friday August 02, 2013 @11:07AM
(#6147362)
Adding a random amount of random bytes will not defeat the attack, it would only slightly increase the amount of time required by making the side channel noisier.
Adding a fixed amount of random bytes will have no benefit at all.
Re:SSL, Gone in 30 seconds
by quizotic on Friday August 02, 2013 @03:36PM
(#6149158)
Not following your assertion. Suppose the reported size was always a random epsilon larger than the actual size. Choose epsilon so that its small enough to benefit from compression and large enough to obscure the BREACH. Why doesn't that work?
Adding a fixed amount of random bytes will have no benefit at all.