From: Steffan Karger Date: Sun, 3 Jun 2018 10:11:56 +0000 (+0200) Subject: man: add security considerations to --compress section X-Git-Tag: v2.4.7~42 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6795a5f3d55f658fc1a28eb9f3b11d1217e3329c;p=thirdparty%2Fopenvpn.git man: add security considerations to --compress section As Ahamed Nafeez reported to the OpenVPN security team, we did not sufficiently inform our users about the risks of combining encryption and compression. This patch adds a "Security Considerations" paragraph to the --compress section of the manpage to point the risks out to our users. Signed-off-by: Steffan Karger Acked-by: Gert Doering Message-Id: <1528020718-12721-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16919.html Signed-off-by: Gert Doering (cherry picked from commit a59fd1475089eda4c89942d345070bb942180223) --- diff --git a/doc/openvpn.8 b/doc/openvpn.8 index 7512bfb5a..c99248c64 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -2516,6 +2516,16 @@ If the parameter is empty, compression will be turned off, but the packet framing for compression will still be enabled, allowing a different setting to be pushed later. + +.B Security Considerations + +Compression and encryption is a tricky combination. If an attacker knows or is +able to control (parts of) the plaintext of packets that contain secrets, the +attacker might be able to extract the secret if compression is enabled. See +e.g. the CRIME and BREACH attacks on TLS which also leverage compression to +break encryption. If you are not entirely sure that the above does not apply +to your traffic, you are advised to *not* enable compression. + .\"********************************************************* .TP .B \-\-comp\-lzo [mode]