[cifs-protocol] [EXTERNAL] Re: [MS-XCA] is LZ77 + Huffman the same as the Win32 compression API? - TrackingID#2210190040006868

[Obaid Farooqi]

Hi Douglas:
Yes, AD uses the same API for compressing the claims.
I am not the right person to ask API related questions. I and my team support open specifications. You are welcome to try forums that discuss Windows APIs such as stack overflow.

Please let me know if this does not answer your question.

Regards,
Obaid Farooqi
Escalation Engineer | Microsoft

-----Original Message-----
From: Douglas Bagnall <douglas.bagnall at catalyst.net.nz> 
Sent: Wednesday, October 19, 2022 5:48 PM
To: Obaid Farooqi <obaidf at microsoft.com>; cifs-protocol at lists.samba.org
Cc: Microsoft Support <supportmail at microsoft.com>; Tom Devey <Tom.Devey at microsoft.com>
Subject: [EXTERNAL] Re: [MS-XCA] is LZ77 + Huffman the same as the Win32 compression API? - TrackingID#2210190040006868

thanks Obaid,

This is helpful.

> SMB compression has its own decision logic about whether to compress or not to compress given data. Is your research purely for understanding the compression algorithm described in MS-XCA or are you studying it to implement compression in SMB?
Actually I am most interested in compression for AD claims, mentioned in MS-ADTS 2.2.18.4, though I am hoping my work will also be applicable to SMB.

I am interested in the API used in Windows so I can develop a set of test vectors and verify my understanding of MS-XCA.

> SMB does not use the API that you mentioned for compression. It uses 
> the following API
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flear
> n.microsoft.com%2Fen-us%2Fwindows-hardware%2Fdrivers%2Fddi%2Fntifs%2Fn
> f-ntifs-rtlcompressbuffer&data=05%7C01%7Cobaidf%40microsoft.com%7C
> 0bb8261326974bbd316d08dab223ebc6%7C72f988bf86f141af91ab2d7cd011db47%7C
> 1%7C0%7C638018164597821737%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDA
> iLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd
> ata=9y3q2TpRqsxX77JsM3sNlXzRWyAY5mYceD%2BAYwnJTBI%3D&reserved=0

Do AD claims also use this API?

With regard to the UncompressedChunkSize parameter, is that only of importance to the LZNT1 algorithm (MS-XCA 2.5.1)?

> and SMB only uses COMPRESSION_ENGINE_STANDARD.

Just so I am sure I understand, that would be an implementation choice, rather than a part of the protocol, since both STANDARD and MAXIMUM produce data in the same format, with the latter just exerting more effort, and the decompressor doesn't need to know which was used?

thank you,

Douglas