| |||||||||||||
Different compression schemeDifferent compression schemePosted Sep 20, 2012 5:45 UTC (Thu) by alonz (subscriber, #815)In reply to: Different compression scheme by epa Parent article: CRIME Attack Uses Compression Ratio of TLS Requests as Side Channel to Hijack Secure Sessions (threatpost) Another option is to reset the compression state between the headers and payload (I know many compression schemes have a special control code to do this — unfortunately I don't know if SSL/TLS compression does).
(Log in to post comments)
Different compression scheme Posted Sep 20, 2012 11:43 UTC (Thu) by epa (subscriber, #39769) [Link]
Here I think the attacker can add things to the headers, such as cookies or the exact path being requested. So you would need to reset the compression state between one header line and the next.
|
|||||||||||||