Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gtDEn-0004OL-2c for pgsql-hackers@arkaria.postgresql.org; Mon, 11 Feb 2019 15:11:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1gtDEk-0007H2-6Q for pgsql-hackers@arkaria.postgresql.org; Mon, 11 Feb 2019 15:11:10 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gtDEj-0007G4-Mk for pgsql-hackers@lists.postgresql.org; Mon, 11 Feb 2019 15:11:10 +0000 Received: from mail-co1nam03lp2051.outbound.protection.outlook.com ([104.47.40.51] helo=NAM03-CO1-obe.outbound.protection.outlook.com) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1gtDEX-0004iR-A2 for pgsql-hackers@postgresql.org; Mon, 11 Feb 2019 15:11:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=PennO365.onmicrosoft.com; s=selector1-isc-upenn-edu; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6bkWCds3rnSx+HW3VbxL/QPSegpuR39XUVRGkzBjLPE=; b=Lll6LdUA4HThm+YJpXBrWF35zwXJUHbWCCDwSV0XydMyv7LOJBVKpTVZyNR1myFLCJCUB+KS/2HobMK0tgFYyieHSwfjxhqs6r17qMncyDvuWtcLp0fERGKU8Ci9ltnTxp7DdMTqMv0RG5gRQxEFghAqlsgRMkZY8bNh144wuNs= Received: from MWHPR10MB1358.namprd10.prod.outlook.com (10.169.232.143) by MWHPR10MB1918.namprd10.prod.outlook.com (10.175.51.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.17; Mon, 11 Feb 2019 15:10:54 +0000 Received: from MWHPR10MB1358.namprd10.prod.outlook.com ([fe80::fcfd:3dea:79af:943]) by MWHPR10MB1358.namprd10.prod.outlook.com ([fe80::fcfd:3dea:79af:943%8]) with mapi id 15.20.1601.016; Mon, 11 Feb 2019 15:10:54 +0000 From: "Hamlin, Garick L" To: Konstantin Knizhnik CC: Andreas Karlsson , Andres Freund , PostgreSQL Hackers Subject: Re: libpq compression Thread-Topic: libpq compression Thread-Index: AQHUwhv7PbgAwBz1BE6bRcb92NxxYg== Date: Mon, 11 Feb 2019 15:10:54 +0000 Message-ID: <20190211151051.GA18279@isc.upenn.edu> References: <20190208071431.skfmpbeclrkpzuac@alap3.anarazel.de> <8d210267-a2fa-662f-b167-0e5991d45dd7@proxel.se> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: BN6PR08CA0059.namprd08.prod.outlook.com (2603:10b6:404:b9::21) To MWHPR10MB1358.namprd10.prod.outlook.com (2603:10b6:300:21::15) authentication-results: spf=none (sender IP is ) smtp.mailfrom=ghamlin@isc.upenn.edu; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2607:f470:2:1:baca:3aff:fe8b:a2a1] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;MWHPR10MB1918;6:PyVYM+mLHzC1UAijVSlnDJNs/90zV8UKMwxNBbk9kX/WuAfRiIY+ISwHx0r1Uf70wIA/h0rYtb1xFWrFFcpMjOh7f7F+oYnWY09COAtXb97/1WsqXr+o2/4lUDe6nUu21v+uxPgnXQUyGJoCCWt372+h1F0tv0KYqarXUdHJW+laG75LKTWIIgMoenat2hJxAHC6VeJ9Dk+1aiIy55e4q1JClRG6fqolIWVoR9++QpOjUDfdUMjdsQCLuhp9bWC+GBlvaiPrOI7gO7myiIokjwnfbVav51L89NIIItHWtS1+wR50yY73pzPYCV02cy+yj7ntRXzJfuSiBzhdcJbCcLUpg188cDtEQpk9LXSy9UfN4/AKr4I1PedYRQqKirFO2UopCYtkNV/CxaIilbICsE+I3B42g1MblvQhnHVPOZxBSLgd/QIItpRXhxBE/xq4yJiBnvMKCPXHXpD8n6+FtA==;5:+PPM0A2w4ieOPnpFG6qySxg+rqwW6uLO+101DdZL94L+4jeqUUVloJfW47LsjI/G5dgHhrXm6fwXbKNir+HfhN79Wz65PSTs09SRtn9o0Q38SvzjMBOdi7cNEuYbkkdrZ8dRa2P+RfqatLdwip0wXc37Ryc6MOeheoap/AB7c1N8miJ3r/Y36OLb6+D9F4qnZ+NvX+vAF6Ju2GytW5ncbg==;7:Oc5Iy2sbpV+8oirrP7VitBhmu//omOmSk+maQdhtnvhA6D/qn+FPd5khbMA9OtSUqiPmtGz+p1++DYHM2kMsEZhmlr5ohd//owCgZkeKjnT9bR+H8k2EsspNCrOn7N/itXNGAoyWWMM55WFaG433CQ== x-ms-office365-filtering-correlation-id: 29d37cab-047c-461b-b5d3-08d690331e2c x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020);SRVR:MWHPR10MB1918; x-ms-traffictypediagnostic: MWHPR10MB1918: x-microsoft-antispam-prvs: x-forefront-prvs: 0945B0CC72 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(396003)(39860400002)(366004)(136003)(346002)(376002)(189003)(199004)(486006)(386003)(68736007)(6116002)(52116002)(53936002)(4744005)(256004)(88552002)(186003)(316002)(71200400001)(71190400001)(76176011)(3480700005)(1076003)(476003)(6506007)(446003)(99286004)(11346002)(2616005)(74826001)(786003)(54906003)(221733001)(46003)(6436002)(6916009)(7116003)(8936002)(97736004)(305945005)(105586002)(86362001)(81156014)(25786009)(2906002)(102836004)(6512007)(8676002)(81166006)(106356001)(7736002)(75432002)(14454004)(4326008)(6486002)(229853002)(478600001)(93886005)(33656002)(6246003)(111123002);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR10MB1918;H:MWHPR10MB1358.namprd10.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1; received-spf: None (protection.outlook.com: isc.upenn.edu does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: W/G+17YiDWB9iX48B8OUsx46b015iD6zHGscUV6bzIq0i7aGvtsva3ZqTiLXTjfJf3g7awLakDBZvii36CaDWP5/bJa3wXMTs2njaEJLoMY/MwtDrdBkhW5vPKCVqZriCq96flxb+MmxCPtgM6F4V+DQ1BTEOMDCbVUJ2jKfvRTWDudd6GKSm4RIfQsnkLIw07t055GgCAtA+VkGaQje6zkOR/4oREZxN2Roq+aQqo84ZuNjIbdwtUbCsXX0DInWihDl+PaFwO8x1zlO0Qtz+i2pp2AloUYXHabxk0XQty56CVdseXxDy2lkJeOMvIncbyMqWdSyp71Saw2DX86EPdN+cYLIRDBWqMwONUbL5f2/oYlfDszo4dpc3Qav+kWO8IflIV8wQxdvfqh8kQp8kW0uQJic57/fVpUfJmGeP38= Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: isc.upenn.edu X-MS-Exchange-CrossTenant-Network-Message-Id: 29d37cab-047c-461b-b5d3-08d690331e2c X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Feb 2019 15:10:53.8438 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 6c4d949d-b91c-4c45-9aae-66d76443110d X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1918 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk On Mon, Feb 11, 2019 at 05:56:24PM +0300, Konstantin Knizhnik wrote: >=20 > Also such attack is possible only if session_id can be somehow "guessed".= If > it is just big random number, then it is very unlikely that it can be hac= ked > in in this way. I am not arguing against compression, but this point isn't exactly true. The _uniformity_ of the key makes a big difference in the practicality of the attack, not the total entropy. For example, if the session_id was a 128 bit hex string and I knew or guessed the characters before the secret part and could send data that ende= d up near the secret then I can guess one character at a time and infer the guess is correct when the size of the packet gets smaller. IOW, I really only have to guess with 1/16 odds each digit (because its a hex string in this example). In the case, the 128 bit secret only provides the effective protection of an 8-bit secret because it can be guessed left to right 4 bits at a time. =20 Garick