[cifs-protocol] [MS-XCA] is LZ77 + Huffman the same as the Win32 compression API? - TrackingID#2210190040006868

[Douglas Bagnall]

thanks Obaid,

This is helpful.

> SMB compression has its own decision logic about whether to compress or not to compress given data. Is your research purely for understanding the compression algorithm described in MS-XCA or are you studying it to implement compression in SMB?
Actually I am most interested in compression for AD claims, mentioned in 
MS-ADTS 2.2.18.4, though I am hoping my work will also be applicable to SMB.

I am interested in the API used in Windows so I can develop a set of 
test vectors and verify my understanding of MS-XCA.

> SMB does not use the API that you mentioned for compression. It uses the following API
> https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlcompressbuffer

Do AD claims also use this API?

With regard to the UncompressedChunkSize parameter, is that only of 
importance to the LZNT1 algorithm (MS-XCA 2.5.1)?

> and SMB only uses COMPRESSION_ENGINE_STANDARD.

Just so I am sure I understand, that would be an implementation choice, 
rather than a part of the protocol, since both STANDARD and MAXIMUM 
produce data in the same format, with the latter just exerting more 
effort, and the decompressor doesn't need to know which was used?

thank you,

Douglas