User: Password:
Subscribe / Log in / New account

Any server-side defenses?

Any server-side defenses?

Posted Sep 13, 2012 21:26 UTC (Thu) by cyanit (guest, #86671)
In reply to: Any server-side defenses? by kmself
Parent article: CRIME Attack Uses Compression Ratio of TLS Requests as Side Channel to Hijack Secure Sessions (threatpost)

The server chooses whether to use compression in the ServerHello, so it should be possible to have the server avoid requesting compression at all.

Some non-compliant clients might perhaps not like it though, not sure.

Of course, this is suboptimal compared to the client avoiding compression of sensitive parts, but I'm not sure how the server could detect that the client is fixed.

Maybe the TLS standard should be amended to add new compression algorithm identifiers that tell the server that the client knows to securely compress HTTP requests.

(Log in to post comments)

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds