while working with Encryption mostly cipher text is always larger the plain text, why isn't that the case when downloading a file using https ? even that compression isn't much used anymore because if the CRIME and BREACH exploits the file still has the exact same size as a http download.

UPDATE : something i may be thinking of is that the browser or whatever tool only tells you about the size after decryption ?


[After your edit I can confirm that the browser does the whole encryption in the background - you only get the "normal" HTTP connection to see and the downloaded files appear as big as the unencrypted files - even if the encrypted files are only marginally bigger. You don't ever see the encrypted version without some addition work. You can use a secure connection like a normal one.]

Here a explanation why the exchanged data is slightly bigger than with unsecured connections: Ciphertext is mostly only slightly larger than the plaintext, not a significant part if the plaintext is already pretty large. At first (with for example TLS) we create a session which exchanges some data to authenticates the connection and generate a secure session key. This takes not much bytes, maybe a kilobyte. After that only a IV (ca. 16 bytes) and the padding (ca. 1 to 16 bytes) needs to be exchanged - only below ca. 4 percent size increase with 1 kilobyte exchanged plaintext. With bigger file sizes this will be even lower.

  • $\begingroup$ Actually OP seems to be misunderstanding that the whole encryption/decryption (and even compression/decompression) process is done transparently for the user, i.e. when a file is delivered compressed by a server the client decompresses it before giving it to the user, it doesn't just drop the gzipped file into the download folder for the user to deal with. At least that is how I understood the question after it was updated. $\endgroup$ – Thomas Mar 16 '15 at 5:24
  • 1
    $\begingroup$ @Thomas: Yes, I did write my answer before the update and then added the explanation for the "real" question. $\endgroup$ – Nova Mar 16 '15 at 5:26
  • $\begingroup$ i forgot that SSL runs on layer 5 below the normal HTTP so even the HTTP implementation thinks that the size's are same Thanks anyways thats all i needed to know :D $\endgroup$ – XEL Mar 16 '15 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.