Saint CRIME/TIME, Who Weighed Compressed Secrets

Patron of TLS compression, headers that shrink, and everyone who compresses before encrypting.

Life

On 21 September 2012 Juliano Rizzo and Thai Duong presented CRIME, an attack on TLS compression. Because compressing similar data shortens it, by measuring the length of the encrypted traffic an attacker could guess, a piece at a time, secrets such as session cookies. The TIME variant carried the idea into response timing, with no need to spy on the network.

Prayer

O Saint CRIME/TIME, who read secrets from the length of what you cannot see, let us never compress together what is secret and what belongs to the attacker. Amen.

How to celebrate

Celebrated by disabling TLS compression and separating secret data from user-controlled data.

Compress with the secret, and the secret can be measured.