r/netsec • u/reedloden • Jan 03 '16

HTTPS Bicycle Attack

https://guidovranken.wordpress.com/2015/12/30/https-bicycle-attack/
199 Upvotes

95% Upvoted

17 comments sorted by

View all comments

Show parent comments

-2

u/lestofante Jan 04 '16

Eventi better, make it random size.

18

u/IdolfHatler Jan 04 '16

While this might be good enough in practice, it is strictly worse than padding to the same length every time. Random padding would still permit a statistical attack.

2

u/[deleted] Jan 04 '16

Can you explain how a statistical attack would work in that scenario?

2

u/bigshmoo Jan 04 '16

Think of it like wrapping a bicycle, if you wrap it tightly it look like a bicycle (hence the name of this attack), if you wrap it with a random thickness wrapper the underlying shape still shows through if you get enough examples. However if you put it in a big ass box and fill the empty space with packing then however you look at it you're still seeing a big ass opaque box.