Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I was reading this article and had a question....

http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/

As I understand it TLS/SSL work in such a way that even the Requested URL is encrypted. So, my question is...would it be possible to create an SSL proxy that could use BREACH to figure out the requested url from the encrypted response?

share|improve this question
    
These attacks require the adversary to take partial control over the client browser. Since client side scripting allows the malicious script to make the client browser to send requests the script partially controls, the adversary might analyze the resulting cipher text and draw conclusions regarding the parts of the plain text that are unknown. Controlling just a SSL proxy is not enough. –  Henrick Hellström Aug 2 '13 at 0:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.