[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: RE: The sky is falling! XML's dirty secret! Go back! It's

• To: "Simon St.Laurent" <simonstl@s...>
• Subject: Re: RE: The sky is falling! XML's dirty secret! Go back! It's a trap!
• From: "Alaric B. Snell" <alaric@a...>
• Date: Fri, 31 May 2002 09:49:30 +0100
• Cc: xml-dev@l...
• In-reply-to: <1022800012.803.3707.camel@l...>
• References: <EDOIJIGA51TRTS8761HFHBVSJFCNMG.3cf6abb5@MChamp> <1022800012.803.3707.camel@l...>

On Friday 31 May 2002 00:06, you wrote:

> I wonder if you could turn that to your advantage by encrypting
> [element] content using different mechanisms on a per-element basis, and
> leaving the structure in plaintext.  That would leave attackers with a
> skeleton but only small bits of content to analyze.

Heh. How much information is in the structure? Quite a lot, and potentially 
useful to an attacker... imagine finding the following travelling between a 
dialup account traceable to you and a porn site:

<purchase>
 <deliver-to>XXXXXXXXXXXXXXXXXXX</deliver-to>
 <items>
  <item code="XXXXX" qty="XXXXX" />
  <item code="XXXXX" qty="XXXXX" />
  <item code="XXXXX" qty="XXXXX" />
  <item code="XXXXX" qty="XXXXX" />
 </items>
</purchase>

Just encrypt the lot, with a couple of safeguards against cribbing as I 
suggested - adding randomness helps :-)

Pick 16 or more bytes of randomness and stick them at the beginning of the 
file, then store the gzipped XML after it, optinally XORing a copy of those 
16 bytes into the start (and end?) of the gzipped stream to obfuscate any 
constants to be found in headers and footers...

> Dunno.  It likely depends on the algorithm used as well as the level of
> repetition in the content, and attributes are a problem as usual.

Yes.

ABS

• References:
  • Re: RE: The sky is falling! XML's dirty secret! Go back!It's a trap!
    • From: Mike Champion <mc@x...>
  • Re: RE: The sky is falling! XML's dirty secret! Go back!It's a trap!
    • From: "Simon St.Laurent" <simonstl@s...>

• Prev by Date: Re: Question: Plugins in XML?!!!
• Next by Date: Re: The sky is falling! XML's dirty secret! Go back! It's a trap!
• Previous by thread: Re: RE: The sky is falling! XML's dirty secret! Go back!It's a trap!
• Next by thread: Re: The sky is falling! XML's dirty secret! Go back! It's a trap!
• Index(es):
  • Date
  • Thread