CRIME

cryptographysecurity

A 2012 attack recovering secrets by observing the size of compressed TLS requests.

Compression Ratio Info-leak Made Easy exploited TLS-level compression: injecting guesses and watching the compressed length reveal when a guess matched secret content like a session cookie. The fix was to disable TLS compression.

CRIME attacked compression rather than encryption. TLS could compress data before encrypting it, and compression works by finding repetition, so the size of the encrypted output leaks information about how much the plaintext repeated. An attacker who can inject content into a request and observe its encrypted length can determine, guess by guess, whether their injection matched a secret already present, such as a session cookie.

The elegance and the horror are the same thing: the encryption is not broken at all. Every guarantee about confidentiality of content holds, and the length of the ciphertext, which no design treated as sensitive, gives the secret away. It is the clearest practical demonstration that side channels are not exotic and that metadata about encrypted data can be as revealing as the data.

The immediate fix was disabling TLS compression, which was straightforward. The follow-on attacks were not, because compression also happens at the HTTP layer, where it is far too valuable to disable, and defending that required separating secrets from attacker-controlled content and masking tokens per request. That is a much harder engineering problem, which is why this family persisted long after the original was closed.

Also known as: CRIME, Compression Ratio Info-leak Made Easy, CVE-2012-4929

← All glossary entries