Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading this article and had a question....

As I understand it TLS/SSL work in such a way that even the Requested URL is encrypted. So, my question is...would it be possible to create an SSL proxy that could use BREACH to figure out the requested url from the encrypted response?

share|improve this question
These attacks require the adversary to take partial control over the client browser. Since client side scripting allows the malicious script to make the client browser to send requests the script partially controls, the adversary might analyze the resulting cipher text and draw conclusions regarding the parts of the plain text that are unknown. Controlling just a SSL proxy is not enough. – Henrick Hellström Aug 2 '13 at 0:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.