Questions tagged [compression]

the act of compression reduces the size of the file(s) being compressed by encoding information and eliminating statistical redundancy.

Filter by
Sorted by
Tagged with
0 votes
1 answer
99 views

Fuzzy hash of a file

Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
Moooz's user avatar
  • 35
0 votes
0 answers
35 views

Which is preferable compress and encrypt or just encrypt and no compression in purely security perspective and not in resources or efficiency? [duplicate]

I want to know what attack am I exposed to if I implement one of the two method. I'm pretty sure both of them are not 100% fool-proof and both of them are expose to traffic-analysis attack if I do ...
Opah's user avatar
  • 1
22 votes
2 answers
4k views

Is compression mandatory with TLS?

I've had a look within the official TLS specification but I cannot see any mention of this. Does TLS allow compression to be disabled? Or is it mandatory?
intrigued_66's user avatar
0 votes
1 answer
88 views

Does filesystem compression aid cryptanalysis?

I use LUKS to encrypt all sensitive data on my computer. If I switch to using a filesystem with on-the-fly data compression such as ZFS, should I use its compression feature together with LUKS? Does ...
CurtisB's user avatar
  • 23
0 votes
1 answer
852 views

Gzip only request body of HTTPS request security BREACH?

I'm not an expert of security. I heard it's not recommended to enable GZIP compression for HTTPS requests, that would open a security issue (see SO answer: https://stackoverflow.com/a/4063496/17307650 ...
Zorgatone's user avatar
  • 135
3 votes
0 answers
624 views

Protection against JPEG compression bombs

There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and in theory PNG/JPEG images might be a compression-bomb. I've found an ...
salazar324's user avatar
0 votes
1 answer
215 views

Any risk on viewing the content of a RAR file without extracting it?

lets say I have a rar file that has a bunch of images inside. Is there any risk of opening the image inside the rar without extracting the entire file?
zhili wang's user avatar
7 votes
1 answer
824 views

How sensitive are acoustic side-channels to compression with a narrowband codec?

Assume sensitive audio emissions from a mechanical keyboard. These audio emissions are often sufficient to reconstruct the actual key presses that generated the sound. If the audio is compressed using ...
forest's user avatar
  • 66.5k
4 votes
2 answers
2k views

Compression and Encryption against security issues

I'm having a hard time knowing whether the following setup is vulnerable to CRIME/BREACH type attacks (which target HTTPS). I am running a Wireguard VPN that tunnels VXLAN protocol, using ChachaPoly20 ...
Orsiris de Jong's user avatar
1 vote
0 answers
320 views

CyberChef Challenge #21 [closed]

The challenge data is: ...
CtfLover's user avatar
3 votes
3 answers
709 views

Does compression level influence security of encryted 7z files?

I want to archive some GB of sensitive data. It is to be stored on an external drive that also includes non sensitive data so i don't want to encrypt the whole drive. For that purpose i want to use ...
WiCloverS18's user avatar
0 votes
1 answer
173 views

Obscure compression before encrypting

Assuming whatever encryption algorithm used was designed to support compression without any information leakage, would there be any reason not to use some custom compression algorithm to add obscurity ...
mwpuppire's user avatar
3 votes
1 answer
974 views

Does TLS 1.3 mitigate the BREACH vulnerability?

Section 5.4 of the TLS 1.3 specification describes record padding. One of the mitigations for BREACH is to add random padding. Therefore, I'm wondering: Does TLS 1.3 require random record padding? I'...
candrews's user avatar
  • 131
11 votes
1 answer
2k views

Does it weaken the encryption of SSH to use compression?

When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
TopherIsSwell's user avatar
3 votes
1 answer
624 views

What steganographic techniques can I use in images that survive lossy compression?

Learning a bit about IT security, a segment of the material was the basics of steganography - specifically, hiding information in the lowest significance bits of images, and converting images into ...
sisisisi's user avatar
  • 193
5 votes
2 answers
2k views

How are websites actually mititating BREACH? (HTTPS + compression)

After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
reed's user avatar
  • 15.7k
1 vote
1 answer
1k views

Lost RAR password, is there any way to access my data? [closed]

I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
Stan.E's user avatar
  • 21
2 votes
1 answer
112 views

What method to compress English by hand has the highest compression ratio? [closed]

Solitaire is a method for encrypting messages by hand. Reading it though, the only advantage the Solitaire has over a one time pad is that it can encrypt longer messages. It requires a new, random key ...
PyRulez's user avatar
  • 2,937
8 votes
1 answer
3k views

How to protect websites against ZIP bombs and reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) -...
T.Todua's user avatar
  • 2,727
0 votes
1 answer
103 views

Can a compressed archive be constructed in a way to extract into system folders?

Using compression utilities, is it possible to create an archive that when extracted, will place certain files in certain areas on a users PC? For example, suppose if I wrote a virus or a malicious ...
user avatar
0 votes
1 answer
512 views

Which HTTP Compression should I use (and how?)

I know that there are multiple HTTP Compression tools out there. In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use? Also, how ...
JohnFF's user avatar
  • 144
3 votes
1 answer
226 views

How does CRIME work against cookies

Wiki on CRIME: CRIME <...> is a security exploit against secret web cookies RFC 2616 on Content-Encoding: The Content-Encoding entity-header <...> when present, its value indicates what ...
eddyP23's user avatar
  • 289
-5 votes
3 answers
2k views

Which encryption algorithm allows for the less output data than source data? [duplicate]

I am trying to figure out how to get my source information to compile smaller using encrypted text. This could potentially change the game in transferring large-chunked data and offer security at the ...
DeerSpotter's user avatar
0 votes
1 answer
457 views

What is the algorithm for ARJ encrypted files?

I came across some password protected ARJ files. What is the algorithm for ARJ encrypted files ? How to decrypt them ?
franck's user avatar
  • 170
0 votes
2 answers
384 views

Best way to encrypt user data stored in xml?

First of all I am not very familiar with the world of encryption so please be nice. I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
KayJay's user avatar
  • 1
2 votes
0 answers
179 views

BREACH attack against SPA

I have a single page application that is hosted at example.com that relies on api.example.com. The SPA sends user credentials (JWT token) in authorization header for every request. Let's suppose ...
J Doe's user avatar
  • 21
15 votes
1 answer
899 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
forest's user avatar
  • 66.5k
3 votes
2 answers
670 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
Arthur's user avatar
  • 33
2 votes
1 answer
91 views

Application control of HTTP content compression [closed]

How does an application control whether or not its http content is compressed? I am not talking about TLS level compression, but rather about the compression of https:// response bodies only. In ...
Frugal Guy's user avatar
0 votes
2 answers
452 views

How can I select a compression utility that is popular and secure enough

In a previous posting on Which is a safe way to transfer a copy of a sensitive document?, I have received suggestions to compress and encrypt an attachment file using the options of utilities such as ...
XavierStuvw's user avatar
0 votes
0 answers
70 views

Detectability of packing files in Windows 10

I follow the tutorial here: https://www.youtube.com/watch?v=g0RmclTe7Lo to pack calc.exe in windows 10 at C:\Windows\System32\calc.exe But I get the following error: What's the problem? It ...
william007's user avatar
4 votes
2 answers
1k views

Encryption and Compression

I've read that encryption produces random data and compression works by removing patterns in data and as a consequence, encrypted data has high entropy. I'm a bit confused, though. The reason I'm ...
user6189164's user avatar
18 votes
8 answers
15k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
Neli's user avatar
  • 229
4 votes
2 answers
5k views

What are some possible uses of a zip bomb?

This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless. Is this ...
Vegeta's user avatar
  • 41
11 votes
1 answer
3k views

Brotli compression for HTTPS

It appears that Chrome, Firefox, and soon Edge, support the new Brotli compression algorithm over HTTPS only. I can't find anything on whether this new compression algorithm is susceptible to the ...
rink.attendant.6's user avatar
4 votes
1 answer
430 views

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
Tarka's user avatar
  • 141
0 votes
2 answers
415 views

What are the implications of reversing hashes

Today it was posited to me that sha256 has a domain large enough to never encounter a collision and that because it is such a large domain and given that a reverse function was created for it, that ...
virus.cmd's user avatar
  • 101
1 vote
0 answers
727 views

Is it possible to obfuscate binaries with UPX or similar software?

Warez scene groups often compress their binary executables using UPX or similar software. I've heard somewhere that they do this to obscure the algorithms they use from other groups, but I find this ...
krispet krispet's user avatar
1 vote
4 answers
462 views

Why browsers don't support TLS without encryption and deprecate compression for public data

These days we observes trend to use HTTP over TLS (HTTPS) for all communication. It recommend all weighty Internet service vendors and that claims to good practice. But TLS suite have 3 options for ...
slonma's user avatar
  • 11
3 votes
1 answer
106 views

.NET extraction and storage of compression files concerns

I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
Cyassin's user avatar
  • 513
1 vote
0 answers
244 views

The RAR archive format and authenticity verification [closed]

The changelog for RAR 5 mentions the following: Features removed: authenticity verification feature did not provide the required level of reliability and was removed; ... I didn't find any ...
Paul's user avatar
  • 603
1 vote
2 answers
1k views

Various questions about file compression and encryption regarding hacking (zip, rar, 7z) [closed]

So I'm curious about a few aspects of compressed files (Zip, rar, 7z, etc), and how they impact hack-ability. There is enough on this subject that I'm not clear about (since this isn't a career of ...
Durge's user avatar
  • 19
0 votes
1 answer
3k views

Base64 or HEX encoded? [closed]

I have this string encoded and compressed (link to full string) ...
matiq's user avatar
  • 3
2 votes
1 answer
530 views

Decryping a RAR file with same password

I came across a problem very similar recently and wondered if anyone knew how to solve this. So say for example I have an RAR archive called archiveA.rar and a password to protect it the password is ...
munim_R's user avatar
  • 23
8 votes
3 answers
4k views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
microwth's user avatar
  • 2,493
3 votes
3 answers
220 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
Luke's user avatar
  • 187
5 votes
3 answers
2k views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
Aryeh Leib Taurog's user avatar
3 votes
1 answer
525 views

Security risks of symmetric encryption with compression for database data

I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface. Various ...
azren's user avatar
  • 141
2 votes
2 answers
347 views

Can BREACH be thwarted by simply adding a sort of "salt" into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
orokusaki's user avatar
  • 1,352
18 votes
3 answers
12k views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?
Florian Schneider's user avatar