Enhancement: Compress the output of the "Fernet" encryptor

[levigross]

The field contains more than just the cipher text and it may be nice to compress (zlib) the output of the "Fernet" encryptor.

[danaspiegel]

@levigross what purpose does the compression you recommend serve?

[levigross]

Save DB space.

On Mon, May 11, 2015 at 1:52 PM, Dana Spiegel [email protected]
wrote:

@levigross https://github.com/levigross what purpose does the
compression you recommend serve?

—
Reply to this email directly or view it on GitHub
#3 (comment)
.

[apolkosnik]

You don't really want to compress encrypted data, you want to first compress, then encrypt.

[levigross]

@apolkosnik No you don't :). Compressing than encrypting leads to attacks like CRIME (https://en.wikipedia.org/wiki/CRIME) and BREACH (https://en.wikipedia.org/wiki/BREACH_(security_exploit))

[apolkosnik]

If you're trying to compress bytes with large degree of randomness (e.g. ciphertext) then you are wasting your CPU cycles, because the result will have useless compression ratio.