[cifs-protocol] [EXTERNAL] Re: [MS-XCA] is LZ77 + Huffman the same as the Win32 compression API? - TrackingID#2210190040006868

[Obaid Farooqi]

Hi Douglas:
While I am not at the stage where I can confirm " With regard to the UncompressedChunkSize parameter, is that only of importance to the LZNT1 algorithm (MS-XCA 2.5.1)?", what I can confirm that UncompressedChunkSize is irrelevant for XPRESS and XPRESS_HUFF. 

I am working on your other questions and will be in touch as soon as I have an answer.

Regards,
Obaid Farooqi
Escalation Engineer | Microsoft

-----Original Message-----
From: Douglas Bagnall <douglas.bagnall at catalyst.net.nz> 
Sent: Friday, October 21, 2022 7:29 PM
To: Obaid Farooqi <obaidf at microsoft.com>; cifs-protocol at lists.samba.org
Cc: Microsoft Support <supportmail at microsoft.com>; Tom Devey <Tom.Devey at microsoft.com>
Subject: Re: [EXTERNAL] Re: [MS-XCA] is LZ77 + Huffman the same as the Win32 compression API? - TrackingID#2210190040006868

hi Obaid,

Yes, this answers the question and is useful.

I understand your concern is the protocol rather than the API, but if this enables me to develop a thousand test vectors, you may have saved yourself a thousand questions.

thanks
Douglas

On 20/10/22 12:36, Obaid Farooqi wrote:
> Hi Douglas:
> Yes, AD uses the same API for compressing the claims.
> I am not the right person to ask API related questions. I and my team support open specifications. You are welcome to try forums that discuss Windows APIs such as stack overflow.
> 
> Please let me know if this does not answer your question.
> 
> Regards,
> Obaid Farooqi
> Escalation Engineer | Microsoft
> 
> -----Original Message-----
> From: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
> Sent: Wednesday, October 19, 2022 5:48 PM
> To: Obaid Farooqi <obaidf at microsoft.com>; 
> cifs-protocol at lists.samba.org
> Cc: Microsoft Support <supportmail at microsoft.com>; Tom Devey 
> <Tom.Devey at microsoft.com>
> Subject: [EXTERNAL] Re: [MS-XCA] is LZ77 + Huffman the same as the 
> Win32 compression API? - TrackingID#2210190040006868
> 
> thanks Obaid,
> 
> This is helpful.
> 
>> SMB compression has its own decision logic about whether to compress or not to compress given data. Is your research purely for understanding the compression algorithm described in MS-XCA or are you studying it to implement compression in SMB?
> Actually I am most interested in compression for AD claims, mentioned in MS-ADTS 2.2.18.4, though I am hoping my work will also be applicable to SMB.
> 
> I am interested in the API used in Windows so I can develop a set of test vectors and verify my understanding of MS-XCA.
> 
>> SMB does not use the API that you mentioned for compression. It uses 
>> the following API 
>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flea
>> r 
>> n.microsoft.com%2Fen-us%2Fwindows-hardware%2Fdrivers%2Fddi%2Fntifs%2F
>> n 
>> f-ntifs-rtlcompressbuffer&data=05%7C01%7Cobaidf%40microsoft.com%7
>> C 
>> 0bb8261326974bbd316d08dab223ebc6%7C72f988bf86f141af91ab2d7cd011db47%7
>> C 
>> 1%7C0%7C638018164597821737%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMD
>> A 
>> iLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&s
>> d
>> ata=9y3q2TpRqsxX77JsM3sNlXzRWyAY5mYceD%2BAYwnJTBI%3D&reserved=0
> 
> Do AD claims also use this API?
> 
> With regard to the UncompressedChunkSize parameter, is that only of importance to the LZNT1 algorithm (MS-XCA 2.5.1)?
> 
>> and SMB only uses COMPRESSION_ENGINE_STANDARD.
> 
> Just so I am sure I understand, that would be an implementation choice, rather than a part of the protocol, since both STANDARD and MAXIMUM produce data in the same format, with the latter just exerting more effort, and the decompressor doesn't need to know which was used?
> 
> thank you,
> 
> Douglas
>