MIME-Version: 1.0
References: <CACzsqT4cJG0kaCbz24Sd=GAEgiQDpzU8yuD6vF25zo870+3M6g@mail.gmail.com>
 <CA+TgmoZ0cq7SoiXWdv5A57gK-k3YXjGcDiRA+RvjCO976LD6iw@mail.gmail.com>
 <CACzsqT5Y2cVES09bm4audEeh10bhsawSReeEgHwHA6NT2NV+BQ@mail.gmail.com>
 <CAGECzQTPf3d4WP2B=t-kRQ3CQMzYSA6jneugkWqp7a3c1XYX0g@mail.gmail.com>
 <CACzsqT5-7xfbz+Si35TBYHzerNX3XJVzAUH9AewQ+Pp13fYBoQ@mail.gmail.com>
 <CA+TgmoY4LWvb2WYRT74UMaKZt+4g2NwCEOQ1KLe94EsphKWNTw@mail.gmail.com>
 <CACzsqT6n0WNUGAK4R+Pn52+hAKWuinMqEjKnfkYkx9EroMwXeA@mail.gmail.com>
 <CA+TgmoZy43rBVypyHujU-ZZuprv4Uh3zYCLO4Yzh2EjeR3A2AA@mail.gmail.com>
 <CA+TgmoYiYC0Z57nctjGFeJD0yQi==imL37K5DA6wRWfu01h_ng@mail.gmail.com>
 <CACzsqT7m+CYi8D=UYPTGHUqjwun==3puHuW8wEA81OyjFKHHEw@mail.gmail.com>
 <CA+TgmoZ1eU35KwTZ6QPsfjMjpx4fkF8z5rVORfppc=Y+0ZHVVQ@mail.gmail.com>
 <CACzsqT4een0jB1hH_vzwif-cA6OcLwbaju7rtUAaRe+BiVSUtw@mail.gmail.com>
 <CA+TgmoaawjOaSUqW2Q53ezsBJRidXKHSmT-qqvahdNks1RNajA@mail.gmail.com>
 <CACzsqT7S+Bk48xvGd9cvhyj0tHWNqzs_SPVs+rDNSsqfR7ymuw@mail.gmail.com>
 <CACzsqT4-E4nYvS7fErmEsOcPVZTuGq4_y9C9iW7g=bwFfS3jgg@mail.gmail.com>
 <CA+TgmoYu8EvvbR1amMmJDW_rPiSgC=11Qx2jJM1z-c0yaLR+Ag@mail.gmail.com>
 <CACzsqT5dSZGzY5cmO88jiCd+T_B1xUCi1LWk6iXsd-Q9Xc=KXA@mail.gmail.com>
 <CA+TgmobS=813B+7XZ+h-w2H8HZd0EAn-ug7HV2D7DF2FRTrTzQ@mail.gmail.com>
 <CACzsqT5S4bAD7o5=X8+RHbwZcZzPipH6NG0Y953Yw5HZmVkeFw@mail.gmail.com>
 <CA+Tgmobuj67e8z=6AdnrStvOtD2QSeTCRthKpjgeNkwJTa+kLQ@mail.gmail.com>
 <CACzsqT6mhei=xiNwQ2JbVGs44bPg+S5KDit1LmiBzdbo=4NSLg@mail.gmail.com>
 <CAOYmi+nLh2kj5=VCYQWJCe5feBPKNYhZ0Q1MaOoCTyoTA1sfLQ@mail.gmail.com>
 <CAGECzQQ4iQ=bhtC4E_rVs6XYAgQMzcjvUr-rGRdKPkGT0VKqgA@mail.gmail.com>
 <CAOYmi+=7J8+WuX5JnuhOHA9vYehbndUYaBW44u+a_x=nJgDw9Q@mail.gmail.com>
 <CA+Tgmob5XzbKa7UaS0eKSv1ReopJ7XkVhBMS+qbLP91iqEQfnA@mail.gmail.com>
 <CAOYmi+=Fyhdq7ePh9s-u9-hJ=iy9tnhWw-_zaN2a+uGYzfJrOQ@mail.gmail.com>
 <CA+TgmoaNFFeyy8x7KKPUxn3VS8MixM7Y1kFjmcbYBqLCfoYjLQ@mail.gmail.com>
 <CAOYmi+n6xQcA664DUDn5HsHTrT2u0hebfNYkgzJ=1J7zSOEx4A@mail.gmail.com>
 <CA+TgmoYqD0zFyX_Zot5g12TNQUeMinJf-ri1B3t0GhG7kVXTvw@mail.gmail.com> <874AA52D-1ACF-4FAE-95B0-9FC72A7DC83D@yandex-team.ru>
In-Reply-To: <874AA52D-1ACF-4FAE-95B0-9FC72A7DC83D@yandex-team.ru>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Mon, 20 May 2024 12:39:49 -0700
Message-ID: <CAOYmi+nv5cndsU5XEvZdDMkfuqC5uG0MtQ+5w8GS8d-FX0yaXQ@mail.gmail.com>
Subject: Re: libpq compression (part 3)
To: "Andrey M. Borodin" <x4mmm@yandex-team.ru>
Cc: Robert Haas <robertmhaas@gmail.com>, Jelte Fennema-Nio <postgres@jeltef.nl>, 
	Jacob Burroughs <jburroughs@instructure.com>, 
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2Bnv5cndsU5XEvZdDMkfuqC5uG0MtQ%2B5w8GS8d-FX0yaXQ%40mail.gmail.com>
Precedence: bulk

On Mon, May 20, 2024 at 11:05=E2=80=AFAM Andrey M. Borodin <x4mmm@yandex-te=
am.ru> wrote:
> > So, the data would be compressed first, with framing around that, and
> > then transport encryption would happen afterwards. I don't see how
> > that would leak your password, but I have a feeling that might be a
> > sign that I'm about to learn some unpleasant truths.
>
> Compression defeats encryption. That's why it's not in TLS anymore.
> The thing is compression codecs use data self correlation. And if you mix=
 secret data with user's data, user might guess how correlated they are.

I'm slow on the draw, but I hacked up a sample client to generate
traffic against the compression-enabled server, to try to illustrate.

If my client sends an LDAP password of "hello", followed by the query
`SELECT 'world'`, as part of the same gzip stream, I get two encrypted
packets on the wire: lengths 42 and 49 bytes. If the client instead
sends the query `SELECT 'hello'`, I get lengths 42 and 46. We lost
three bytes, and there's only been one packet on the stream before the
query; if the observer controlled the query, it's pretty obvious that
the self-similarity has to have come from the PasswordMessage. Rinse
and repeat.

That doesn't cover the case where the password itself is low-entropy,
either. "hellohellohellohello" at least has length, but once you
compress it that collapses. So an attacker can passively monitor for
shorter password packets and know which user to target first.

--Jacob