Hacker News new | past | comments | ask | show | jobs | submit login

The rule is: never compress something secret together with something potentially attacker-influenced.

If the attacker can influence the traffic, they can potentially gather information about the secret by examining the effect of differing traffic patterns on the size of the encrypted result.




No, the rule is: never compress something secret together with something potentially attacker-influenced, at least if the length of the compressed data leaks.


Fixed. That was a typo/thinko.


That's an excellent rule, but that doesn't cover the other example used about voice communications.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: