traffic analysis on TLS packets

[hannesm]

(from http://tools.ietf.org/html/draft-pironti-tls-length-hiding-02):
When using CBC block ciphers, the TLS protocol provides means to frustrate attacks based on analysis of the length of exchanged messages, by adding extra pad to TLS records. However, the TLS specification does not define a length hiding method for applications that require it. In fact, current implementations of eager fragmentation strategies or random padding strategies have been showed to be ineffective against this kind of traffic analysis.

Solution: implement length hiding policy http://tools.ietf.org/html/draft-pironti-tls-length-hiding-02

[hannesm]

closing this, nearly 10 years later there hasn't been a fruitful discussion what to do.