CRIME

cryptographysecurity

A 2012 attack recovering secrets by observing the size of compressed TLS requests.

Compression Ratio Info-leak Made Easy exploited TLS-level compression: injecting guesses and watching the compressed length reveal when a guess matched secret content like a session cookie. The fix was to disable TLS compression.

Also known as: CRIME, Compression Ratio Info-leak Made Easy, CVE-2012-4929

← All glossary entries