News for hackers. Stuff that matters.

A comment on New attack plucks secrets from HTTPS-protected pages. Parent comment

Re:New attack plucks secrets from HTTPS-protected pages by AnIrishDuck on Friday August 02, 2013 @01:09PM (#6148189)
Sure, you can manually isolate secret information from attacker information. That wasn't really what I was looking for.

I was referring to a general compression scheme that could be applied pre-encryption and not leak info when combined with partial plaintext oracle attacks. I don't think such a thing is possible, but it would be awesome if some really smart researchers could prove me wrong.

[ Parent | on HN ]
Re:New attack plucks secrets from HTTPS-protected pages by Scaevolus on Saturday August 03, 2013 @11:49AM (#6152415)
Most compressors are adaptive: they adjust their state depending on previous inputs. A static compressor wouldn't leak anything-- for HTML, it might have preset dictionaries for common tags and attributes (instead of <div>, output a single token), and have a static Huffman encoding tuned to "average" HTML pages. The compression wouldn't be nearly as good as DEFLATE since it has to compress each chunk in isolation, but it would still beat plaintext.
[ Parent | on HN ]