Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What design change would you add to the GZIP algorithm so that it makes sure that compression oracle is not present anymore? This is assuming that both the INFLATE and DEFLATE endpoint designs can be changed.

Basically, am asking some suggestion which changes the GZIP output length every time, for the same payload every time, without changing the meaning of the actual plain text data.

I got some inspiration from this blog post on an elegant fix, http://jbp.io/2013/12/17/crime-vs-zlib/#countermeasure-dynamic-compression-window-adjustment

However, is it possible to have a solution without specifically mentioning the secret artifacts, like cookies etc?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.