21.5 Compression-based attacks
Earlier in this chapter, we learned how error messages or timing behavior of Alice’s TLS implementation create a side channel providing information about the inner workings of the decryption process. Eve can, in turn, use this information to construct an oracle allowing her to compromise TLS security.
It turns out that lossless compression can also create a similar side channel. In a nutshell, lossless compression allows Eve to extract plaintext from an encrypted communication if she knows or can guess certain characteristics of the plaintext (for example, if she correctly guesses that some string s is present in the plaintext).
Between 2012 and 2016, security researchers published four attacks on TLS – CRIME, TIME, BREACH, and HEIST – that exploit the compression side channel. To understand these attacks in depth, let’s first look at how some common lossless compression algorithms work.