Subject: about rfc2393

From: Jerome Etienne <[email-masked]>
Date: Thu, 10 Dec 1998 15:59:49 -0500

quote from rfc2393

"5. Security Considerations

   When IPComp is used in the context of IPSec, it is believed not to
   have an effect on the underlying security functionality provided by
   the IPSec protocol; i.e., the use of compression is not known to
   degrade or alter the nature of the underlying security architecture
   or the encryption technologies used to implement it.
"

but in fact the compression increases the encryption scheme, because
it reduces the redondancy of the plain text which is so usefull for
cryptanalysis.

---

From: Hovav Shacham <[email-masked]>
Date: 12 Dec 1998 05:56:22 -0800

Jerome Etienne <[email-masked]> writes:

>    When IPComp is used in the context of IPSec, it is believed not
>    to have an effect on the underlying security functionality
>    provided by the IPSec protocol; i.e., the use of compression is
>    not known to degrade or alter the nature of the underlying
>    security architecture or the encryption technologies used to
>    implement it.  [RFC 2392]
> 

Yes and no.  Dictionary attacks play only a minor role in modern
cryptanalysis.  The encryption algorithms used in IPSec (e.g., DES in
CBC mode; see RFCs 2405 and 2406) are designed to hide plaintext
repetitions, so redundancy is probably not a problem.

Besides, it is not clear that compression hides structure.  In a
nightmare scenario, the output from compression could be structured
exactly such that decryption happens to be easy.  Making security
arguments about subsets of the plaintext space is very difficult.

I think the RFC phrasing is fine as is.

Hovav.