It seems like the solution is to special case sensitive headers like "Cookie", so that the compressed version doesn't leak information. But isn't every byte equally worthy of protection? What if there's sensitive information in the body?
(I get that the format of the Cookie header is probably much more structured/predictable than usernames or account details that might appear in the body, but surely a good cryptosystem would be 100% resistent to these sorts of side-channel attacks, without any need to guess which headers need to be handled more carefully.)
This attack depends on being able to control the requests made; cookies are automatically added to the request, which makes them vulnerable. There aren't many times when you'll have enough control over a portion of the body to make non-cookie attacks viable.
SPDY header compression only compresses the headers. Bytes in the body might be vulnerable to a similar attack if the server is doing gzip compression, and that would be a fun extension to the attack, but headers and body are never compressed together.
Comments
It seems like the solution is to special case sensitive headers like "Cookie", so that the compressed version doesn't leak information. But isn't every byte equally worthy of protection? What if there's sensitive information in the body?
(I get that the format of the Cookie header is probably much more structured/predictable than usernames or account details that might appear in the body, but surely a good cryptosystem would be 100% resistent to these sorts of side-channel attacks, without any need to guess which headers need to be handled more carefully.)
This attack depends on being able to control the requests made; cookies are automatically added to the request, which makes them vulnerable. There aren't many times when you'll have enough control over a portion of the body to make non-cookie attacks viable.
SPDY header compression only compresses the headers. Bytes in the body might be vulnerable to a similar attack if the server is doing gzip compression, and that would be a fun extension to the attack, but headers and body are never compressed together.