# What Is CRIME (Compression Ratio Info-leak Made Easy)?

> CRIME is a 2012 attack (CVE-2012-4929) that recovers secrets such as cookies by observing how TLS-level compression changes ciphertext length.

Source: https://ssl.sh/glossary/crime/
Last updated: 2026-11-10

CRIME was presented in 2012 by Juliano Rizzo and Thai Duong, the researchers behind [BEAST](https://ssl.sh/glossary/beast/). When TLS compresses data before encrypting it (TLS 1.2 and earlier could negotiate DEFLATE compression), the size of each encrypted record depends on how well its content compresses. An attacker who can make the browser send requests containing chosen text next to a secret, such as a cookie in the same headers, and who can observe encrypted lengths, can guess the secret byte by byte: a correct guess repeats existing text and compresses slightly better. SPDY's header compression was vulnerable in the same way.

## Why it matters
The response was straightforward: browsers disabled TLS compression, server libraries followed, and [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) removed compression altogether. HTTP/2 replaced SPDY's header compression with HPACK, which was designed with this attack in mind. The lasting lesson is that compressing secrets together with attacker-controlled data before encryption leaks information through length. BREACH (2013) applied the same idea to HTTP response compression such as gzip, which TLS settings cannot fix; it needs application-level mitigations, such as masking CSRF tokens per request or not compressing responses that reflect user input alongside secrets.

## Example
```bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep -i '^Compression'
# Compression: NONE
```

## Common misconceptions
- **Turning off gzip in nginx fixes CRIME.** CRIME targets TLS-level compression, which current libraries already disable; gzip is relevant to BREACH, a different attack.
- **CRIME is a reason to avoid HTTP/2.** HTTP/2's HPACK header compression was designed to resist CRIME-style attacks.
- **Encryption hides the size of the data.** TLS hides content, not length; that gap is exactly what CRIME and BREACH exploit.

## Related terms

- [BEAST](https://ssl.sh/zh/glossary/beast/): BEAST 是 2011 年公布的攻击（CVE-2011-3389），利用 SSL 3.0 和 TLS 1.0 中 CBC 模式可预测的 IV，逐字节解密 Cookie 等秘密。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。