Subject: [apps-discuss] Considerations for Protocols with Compression over TLS

From: "KIHARA, Boku" <[email-masked]>
Date: Tue, 23 Oct 2012 23:29:13 +0900

Hello,

I'm writing a draft on cosiderations for protocols with compression over
TLS, since I was shocked by the CRIME attack.
http://tools.ietf.org/html/draft-kihara-compression-considered-harmful-01

What I want to say are:
* the CRIME attack may be applied if compression is applied in any form
* disabling TLS Compression and SPDY header compression is not a perfect
  solution; the threat has not gone!
* there should be some mitigations to take when using compression in TLS

Because I am neither a cryptographer nor a security expert there must
many mistakes in the draft in addition to language faults, but I think
it is good that we have some guides for comression in TLS.
Is IETF the write place to do such things?

Regards,
Boku Kihara.