Subject: [TLS] A question to implementors about compression

From: "Salz, Rich" <[email-masked]>
Date: Tue, 7 Apr 2015 13:23:29 +0000

I want to completely remove TLS-layer compression from the next release of OpenSSL (roughly year-end). If you this will cause interop problems with your stack, can you please let me know?  Thanks.

--
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Martin Thomson <[email-masked]>
Date: Tue, 7 Apr 2015 10:02:24 -0700

On 7 April 2015 at 06:23, Salz, Rich <[email-masked]> wrote:
> I want to completely remove TLS-layer compression from the next release of
> OpenSSL (roughly year-end). If you this will cause interop problems with
> your stack, can you please let me know?  Thanks.

I'm guessing that interop problems with other stacks will be the least
of your concerns: the uncompressed option is pretty well-tested.  NSS
happily doesn't compress.  I'd be more concerned about users who might
have gotten attached to the feature.

---

From: Alex Elsayed <[email-masked]>
Date: Tue, 07 Apr 2015 22:52:18 -0700

Martin Thomson wrote:

>> I want to completely remove TLS-layer compression from the next release
>> of OpenSSL (roughly year-end). If you this will cause interop problems
>> with

Fortunately, LibreSSL ripped it out a while back, and a  large number of 
things got fixed to handle that - so I think it's unlikely this will break 
the entire world; more likely about 10-25% of it (i.e. "nobody built this 
with LibreSSL" or "upstream hasn't taken patches to fix the build on 
LibreSSL").

---

From: Martin Thomson <[email-masked]>
Date: Wed, 8 Apr 2015 09:46:46 -0700

> with LibreSSL" or "upstream hasn't taken patches to fix the build on

Are you suggesting that LibreSSL/OpenSSL prior to the removal would
fail to properly negotiate the absence of compression?  I'm fairly
sure we'd know if that was the case.

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 8 Apr 2015 16:54:11 +0000

> sure we'd know if that was the case.

That's not the case.  OpenSSL interoperates whether compression is
disabled at compile time, run-time or not enabled by the peer.

Disabling it at compile time or even excising the underlying code
reduce the attack surface and effort to support the code.

If some applications insist on negotiating compression, then of
course they are free to abort connections that don't negotiate
compression.

-- 
	Viktor.

---

From: Alex Elsayed <[email-masked]>
Date: Wed, 08 Apr 2015 09:50:49 -0700

Martin Thomson wrote:

>> things got fixed to handle that - so I think it's unlikely this will
>> break the entire world; more likely about 10-25% of it (i.e. "nobody
>> built this with LibreSSL" or "upstream hasn't taken patches to fix the
>> build on LibreSSL").
> 

No, I'm not - however, it entirely removed the #define for the flag that the 
program linking to LibreSSL passes in to turn it on, which meant anything 
that used it failed to compile.