Subject: [tcmtf] Security Threat: Compression Ratio Info-leak Made Easy (CRIME)

From: Martin Stiemerling <[email-masked]>
Date: Thu, 20 Jun 2013 10:13:10 +0200

Hi all,

My fellow Security AD just pointed me to the following security threat 
that might also applicable in the case of tcmtf:
Compression Ratio Info-leak Made Easy (CRIME), see [1].

Just to let you know for your considerations.

   Martin

[1] http://en.wikipedia.org/wiki/CRIME_%28security_exploit%29

-- 
[email-masked]

NEC Laboratories Europe
NEC Europe Limited
Registered Office:
Athene, Odyssey Business Park, West End  Road, London, HA4 6QE, GB
Registered in England 2832014

---

From: "Jose Saldana" <[email-masked]>
Date: Thu, 20 Jun 2013 15:47:42 +0200

Hi, Martin.

I have been reading about the CRIME security exploit, but I think it only
affects if you compress the payload of the packet. What we are planning in
TCMTF is compressing headers in a certain network segment. After that, the
packet is rebuilt to its native form, so the packet arriving to the server
(or to the web browser) will have the same header it had when it was sent.
If you change the header, the packet does not arrive there.

Today we have discussed some security issues here. I hope we will send some
ideas to the list soon.

Thanks!

Jose

> -----Mensaje original-----
> De: [email-masked] [mailto:[email-masked]] En nombre de
> Martin Stiemerling
> Enviado el: jueves, 20 de junio de 2013 10:13
> Para: [email-masked]
> Asunto: [tcmtf] Security Threat: Compression Ratio Info-leak Made Easy
> (CRIME)
> 
> Hi all,
> 
that
> might also applicable in the case of tcmtf:
> _______________________________________________
> tcmtf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tcmtf