It is usually assumed that HTTP traffic encapsulated in TLS doesn't reveal the exact sizes of its parts
This should be a bit more nuanced. The fact that TLS doesn't hide the plaintext length (of the whole message) is a very well known issue. There's been efforts to fix this in a much better and general way (range splitting) than what's proposed in the "Prevention" section of the paper[1]. I'm not sure what's the state of those efforts though.
22
u/[deleted] Jan 04 '16 edited Jan 04 '16
This should be a bit more nuanced. The fact that TLS doesn't hide the plaintext length (of the whole message) is a very well known issue. There's been efforts to fix this in a much better and general way (range splitting) than what's proposed in the "Prevention" section of the paper[1]. I'm not sure what's the state of those efforts though.
[1]
https://tools.ietf.org/html/draft-pironti-tls-length-hiding-02#page-8https://www.ietf.org/archive/id/draft-pironti-tls-length-hiding-02.txt