Skip to content

Instantly share code, notes, and snippets.

@aaronsw
Created September 20, 2012 16:38
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save aaronsw/3756963 to your computer and use it in GitHub Desktop.
Save aaronsw/3756963 to your computer and use it in GitHub Desktop.

Reply to Ben Laurie

I think even a longer ciphertext could end up being faster if the plaintext was compressed. So imagine that the plaintext message is 1K, the cipher(plaintext) is 1K, compress(plaintext) is .2K and cipher(pad(compress(plaintext))) is 1.5K. The browser would only need to download the first .2K before it started displaying the page (since the rest is just padding). It would still continue downloading the padding, so that attackers wouldn’t know what the compressed length was, but the user would experience the page loading as fast as if it was compressed.

The big flaw would be if the user took a next action, the attacker might be able to back-calculate how much of the page they had received how quickly, but humans introduce enough randomness that this would be a far more difficult attack.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment