Subject: [hybi] Base64-like masking (Was: Straw-poll on Masking options)

From: Tomas Franzén <[email-masked]>
Date: Fri, 14 Jan 2011 23:07:54 +0100

On 14 jan 2011, at 21.33, Willy Tarreau wrote:
> On Fri, Jan 14, 2011 at 10:57:19AM -0800, Joshua Bell wrote:
>> 
>> If we're considering options that sacrifice message length for security, do
>> we also need to consider an option where the (unencoded) payload length is
>> sent as something other than a network-order 63-bit integer, to avoid
>> attacks where "GET /" is encoded into the length?
> 
> Cheap maskings such as XOR or Base64 can probably afford having the
> framing masked. With XOR it's trivial, with Base64, we need to base64
> decode the 2nd and third characters to know what framing length is
> used. I agree it's not much convenient but still trivially easy to
> do.

I noticed draft 00 had a 0xFF frame terminator. I didn't follow this list back then (and didn't find anything relevant in archives), so I don't know what the reason was for switching to a length field. Was it merely to support binary data payloads? With a limited set of possible byte values in something like Base64, having a special terminator like that would work again. That way, we wouldn't need a length field, right?

Tomas

---

From: Takeshi Yoshino <[email-masked]>
Date: Mon, 17 Jan 2011 18:13:02 +0900

On Sat, Jan 15, 2011 at 07:07, Tomas Franzén <[email-masked]> wrote:

> I noticed draft 00 had a 0xFF frame terminator. I didn't follow this list
> back then (and didn't find anything relevant in archives), so I don't know
> what the reason was for switching to a length field. Was it merely to
> support binary data payloads?

Basically, yes. IIRC, we had consensus on that 1) we should support binary
frame and 2) we should have only one framing method for simplicity. So, HyBi
draft 01 has length header. One benefit of having length header is that
knowing length in advance helps the receiver allocate buffer for receiving
at once.

> With a limited set of possible byte values in something like Base64, having
> a special terminator like that would work again. That way, we wouldn't need
> a length field, right?
>
> Tomas
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>