Re:Security advisory: Breach and Django
by dvogel on Tuesday August 06, 2013 @01:56PM
(#6168083)
Wouldn't the lifetime of the token have to be <30 seconds, according to the claims made in the paper?
[ Parent
| on HN ]
I don't think so. Here's the snippet from the linked PDF[1]:
> DEFLATE [2] (the basis for gzip) takes advantage of repeated strings to shrink the compressed payload, an attacker can use the the reflected URL parameter to guess the secret one character at a time.
By encrypting the CSRF token (or any other "secret" data you want to roundtrip from server to client and back) with a random IV per request this wouldn't work. The value sent by the client would not be the same as the new token generated by the server (since each has a random IV). Even though the decrypted value of each token is the same, the values presented to the client in the response body are each different and not predictable (to the client).
[1]: http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%2...