CRIME is a compression-based attack that can reveal secrets in encrypted traffic when TLS compression is enabled. By measuring compressed response sizes, an attacker can infer values such as session tokens. Defenders should keep TLS compression disabled and avoid other compression mechanisms that expose secret-dependent length differences.
How CRIME Works
CRIME is a compression side-channel attack against encrypted traffic. When a secret, such as a session token, is reflected into a compressed response, the attacker can infer information from the response size even though the traffic itself remains encrypted.
The attack matters because compression changes the observable length of a message based on repeated or guessable content. That means confidentiality can fail through metadata, not just through direct decryption.
Why Compression Creates a Security Leak
Compression is designed to remove redundancy, but that efficiency becomes dangerous when attacker-controlled input is mixed with secrets in the same compressed context. If the attacker can influence part of the plaintext and measure the resulting size change, they can iteratively test guesses and learn secret values.
This is why TLS compression was the original focus of CRIME, but the underlying lesson applies more broadly. Any mechanism that makes response length depend on secret material can become a side channel.
Where Exposure Comes From
Organisations should look for places where compression is enabled on traffic that also carries authentication material, cookies, bearer tokens, or other secrets. The most important review points are the protocol configuration, the application path that reflects attacker input, and any intermediary that compresses before encryption or exposes length differences in a stable way.
Exposure is often easiest to miss in layered systems, where one team assumes transport settings are safe while another adds compression at the application or gateway layer. A secure design needs both encryption and a careful look at information leakage through size variation.
Defensive Response and Detection
The primary defence is to disable TLS compression and avoid other compression behaviours that mix secret and attacker-controlled content. When compression cannot be removed immediately, reduce the attacker’s ability to measure stable length differences and separate secrets from untrusted input wherever possible.
After a suspected exposure, treat session material as potentially disclosed. Review logs, proxies, and authentication flows for unusual probing patterns, repeated requests with minor input changes, and access that may indicate secret harvesting attempts. Guidance on transport and control hardening is also reinforced in NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST SP 800-57 Key Management, which help anchor encryption and secret handling decisions around disciplined control of sensitive material.
Risk and Threat Considerations
CRIME is dangerous because it turns a performance feature into a confidentiality leak. An attacker does not need to break encryption directly, only to observe how ciphertext length changes as they test guesses against a secret in a compressed channel.
Failure mechanism: Compression creates measurable length differences when secret and attacker-controlled data share the same context, allowing byte-by-byte inference of protected values.
Impact: Session tokens, cookies, and similar secrets can be recovered or narrowed enough to support account takeover, session theft, or follow-on abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-57 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-8 — Transmission Confidentiality and Integrity | CRIME exploits leakage in protected traffic, so transport confidentiality controls are directly relevant. |
| IA-5 — Authenticator Management | CRIME can expose session tokens and similar authenticators, making lifecycle control materially relevant. | |
| SI-4 — System Monitoring | Detection of probing and repeated measurement attempts supports response to secret-inference attacks. | |
| Recommendation — Disable compression on secret-bearing traffic and enforce protected transmission settings that limit side-channel leakage. Rotate and invalidate exposed authenticators after suspected compression-side-channel compromise. Monitor for repeated request patterns that indicate iterative secret inference against compressed responses. | ||
| NIST SP 800-57 | Key Management | The term concerns protection of encrypted traffic where cryptographic material underpins confidentiality. |
| Recommendation — Review cryptographic protections and ensure secret-bearing channels are not exposed to avoidable length side channels. | ||
| CIS Controls v8 | CIS-3 — Data Protection | CRIME is a confidentiality leak affecting sensitive data in transit. |
| Recommendation — Prevent secret-bearing data from being exposed through compression-related length differences. | ||
Practitioner Guidance
What to watch for: Prioritise any environment where compression and secret-bearing traffic intersect, especially if application responses are stable enough for repeated measurement. If a system depends on compression for efficiency, isolate sensitive fields from attacker influence rather than assuming encryption alone is sufficient.
Practitioner takeaway: Treat length leakage as a real confidentiality issue, not a theoretical one, because encrypted traffic can still reveal secrets through side channels.