Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1084723
| From | Hans-Christoph Steiner <hans@eds.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1001335: apt should use TLSv1.3 Record Padding to obscure file size metadata |
| Date | 2021-12-08 22:00 +0100 |
| Message-ID | <DsccF-8tI-5@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
Package: apt Version: 2.3.13 Severity: wishlist apt should pad its TLS connections to obscure the size of the downloaded files from network observers. Right now, an attacker could build an index of all package sizes, then track the size of HTTPS streams to Debian mirrors, and from that, be able to identify most of the packages being downloaded over HTTPS. TLSv1.3 added the possibility to add padding TLS connections: https://tools.ietf.org/id/draft-ietf-tls-tls13-21.html#rfc.section.5.4 GnuTLS already supports it: https://www.gnutls.org/manual/gnutls.html#On-Record-Padding
Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread
Bug#1001335: apt should use TLSv1.3 Record Padding to obscure file size metadata Hans-Christoph Steiner <hans@eds.org> - 2021-12-08 22:00 +0100 Bug#1001335: apt should use TLSv1.3 Record Padding to obscure file size metadata Julian Andres Klode <jak@debian.org> - 2021-12-08 22:50 +0100 Bug#1001335: Hans-Christoph Steiner <hans@eds.org> - 2021-12-09 13:00 +0100
csiph-web