Subject: Re: [hybi] Straw-poll on Masking options

From: Hervé COMMOWICK <[email-masked]>
Date: Mon, 17 Jan 2011 18:57:06 +0100

If i have to made of choice, based on my current experience, I think
HMAC/AES proposal will quickly become as hell for little/medium shared
hosting supplier, because they will need more and more CPU, that he
will not be able to afford so quickly as his bandwith. 
Furthermore, this will add sizeable latency where we really want to be
as quick as possible. The matter of this kind of protocol *in my
opinion* is to be able to be handled nearly at the speed of the media,
as there will be additional processing for each request, and it is
nearly impossible for small packet with HMAC.

So, i vote for proposal 1, which is sufficient in term of security and
address the main goal of this poll.

Regards,

Hervé.

On Wed, 12 Jan 2011 21:00:35 +0100
Salvatore Loreto <salvatore.loreto at ericsson.com> wrote:
> 
> Hi all,
> 
> 
> Masking from the client to the server
> has reached strong consensus within this wg as a mechanism to
> reduce security risks.
> 
> However there is disagreement on the actual method for masking.
> The technical differences, pro and cons, advantages and
> disadvantages, as well as the legal implications of each method
> have already been deeply discussed.
> 
> In order to settle the question of masking and find a way forward
> that has a wide acceptance,
> Joe and I, as HyBi chairs, want to check where the consensus is
> on the following relevant options that have been discussed (and 
> summarized at
> some point in the mailing list by Eric Rescorla)
> 
> 
> 1. a fixed mask carried entirely in the packet.
> 
> 2. A longish repeated mask computed from the packet. For
> concreteness, suppose HMAC-SHA1(<uuid>, <server-conn-key> ||
> <client-conn-key> || <packet-key>), but
>    obviously there's flexibility here.
> 
> 3. A fully generated mask (if so specify also what you would like
> to use e.g. AES-CTR or HMAC-SHA).
> 
> 
> Please indicate your preference(s) or the one can meet your bar for
> "I could live with that";
> In the case you have more then one, please put the choices in a 
> preference order.
> 
> This poll will run until January 18th.
> 
> cheers
> /Sal
> 
> -- 
> Salvatore Loreto
> www.sloreto.com
> 
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
> 

-- 
Hervé COMMOWICK, EXOSEC (http://www.exosec.fr/)
ZAC des Metz - 3 Rue du petit robinson - 78350 JOUY EN JOSAS
Tel: +33 1 30 67 60 65  -  Fax: +33 1 75 43 40 70
mailto:[email-masked]

---

From: Hervé COMMOWICK <[email-masked]>
Date: Mon, 17 Jan 2011 10:01:39 +0100

Regards,

Hervé.