Draft:VORACLE

The VORACLE (short for VPN ORACLE) is a class of compression oracle attacks against virtual private network (VPN) traffic that exploit the use of data compression prior to encryption. According to published research, an active network adversary can infer sensitive information by observing variations in encrypted packet sizes.^[1][2]

VORACLE applies techniques similar to earlier compression-based attacks such as CRIME and BREACH, which targeted TLS and HTTP compression respectively, but at the VPN tunnel layer.^[3]

Compression-oracle attacks rely on the observation that compression algorithms produce shorter output when redundant data is present. If an attacker can influence plaintext that is compressed together with secret values and observe resulting ciphertext lengths, the attacker may infer the secret through adaptive queries.^[1]

Attacks such as CRIME and BREACH demonstrated this technique against web traffic. As a result, TLS and HTTP compression were widely disabled. However, compression remained enabled in some VPN implementations, which researchers identified as a potential residual attack surface.^[4]

The VORACLE technique targets VPN configurations in which user traffic is compressed before encryption. In such configurations, an attacker who can inject or influence victim traffic and observe encrypted packet sizes may be able to perform adaptive length analysis to infer data that share a compression context with attacker-controlled input.^[1]

Whereas CRIME and BREACH operate at higher protocol layers, VORACLE operates at the VPN layer, and therefore is not mitigated by disabling compression in TLS or HTTP alone.^[5]

The issue is independent of the specific encryption algorithm used and arises from the interaction between compression and encryption.^[6]

VORACLE affects VPN deployments that enable compression within encrypted tunnels, including configurations using OpenVPN and other tunneling protocols that apply compression to plaintext prior to encryption.^[7]

The mitigation recommended by researchers and vendors is to disable compression in VPN tunnels, consistent with the approach previously taken for TLS and HTTP compression-oracle attacks.^[7]

After public disclosure, several VPN providers reported disabling compression or changing default configurations in response to the findings.^[7]

Providers that published statements or advisories include Proton VPN,^[8] ExpressVPN,^[9] NordVPN,^[10] AirVPN,^[11] TorGuard,^[12] SAP,^[13] and McAfee^[14].

• Compression oracle attack
• Side-channel attack