Subject: [hybi] Clarification on straw poll (was Re: Straw-poll on Masking options)

From: Adam Barth <[email-masked]>
Date: Wed, 12 Jan 2011 13:45:52 -0800

On Wed, Jan 12, 2011 at 1:42 PM, Willy Tarreau <[email-masked]> wrote:
> On Wed, Jan 12, 2011 at 09:00:35PM +0100, Salvatore Loreto wrote:
>> In order to settle the question of masking and find a way forward that
>> has a wide acceptance,
>> Joe and I, as HyBi chairs, want to check where the consensus is
>> on the following relevant options that have been discussed (and
>> summarized at
>> some point in the mailing list by Eric Rescorla)
>>
>>
>> 1. a fixed mask carried entirely in the packet.
>
> I vote for this one above, which we can improve with a changing mask
> so that the attacker cannot know the relations between bytes in advance
> if some prefer it..
>
>> 2. A longish repeated mask computed from the packet. For concreteness,
>>    suppose HMAC-SHA1(<uuid>, <server-conn-key> || <client-conn-key> ||
>> <packet-key>), but
>>    obviously there's flexibility here.
>
> Definitely not this one, it's far too slow on small frames.
>
>> 3. A fully generated mask (if so specify also what you would like to use
>> e.g. AES-CTR or HMAC-SHA).
>
> Warning, there were two proposals for this one. The first one which does
> not offer better protection than #1, and the second one which requires
> servers and intermediaries to *bufferize all the frame* before being
> able to decipher it, which is very expensive on medium-sized frames,
> and not possible at all for large ones (up to 2^63 bytes).
>
> While I could probably live with the first version, I'd definitely
> reject the second proposal which cannot reasonably be implemented
> at all.

To be clear, I also find the "key at the end" / "buffer the whole
frame" option unacceptable.  Perhaps we should clarify that this is
not the intent of option (3)?

Adam

---

From: Willy Tarreau <[email-masked]>
Date: Wed, 12 Jan 2011 22:53:57 +0100

> not the intent of option (3)?

Yes I think that would help others to make their choices and avoid
any ambiguity later.

Thanks,
Willy

---

From: Maciej Stachowiak <[email-masked]>
Date: Wed, 12 Jan 2011 14:24:41 -0800

> not the intent of option (3)?

+1

Key at end could be applied to any of these proposals, so if it's still being seriously considered, it should be a separate straw poll.

Regards,
Maciej