Subject: [hybi] WebSockets : Question about masqued frames !

From: "Jean-Christophe Bos" <[email-masked]>
Date: Thu, 9 Jun 2011 17:13:25 +0200

Hello everyone,

I wanted to ask you (from France!) about the latest WebSocket's drafts that
I also fully implemented in my own HTTP server (since hixie 76).

On the masked frames, you mentioned earlier, that the mask must be selected
by an high entropy but it seemed illusive.

However, you came back to say that just choose a random mask but always in a
logical of non-predictability.

So, what is the real utility of this mask and that it should not be
predictable except to prevent a simple human readable dump of the
connection?

Why have won so much space on the data payload length and lose unnecessarily
32b for the masks contained in each frame?

WebSockets is indeed a protocol over HTTP over TCP, thus ensuring a good
packets order and lossless.

So why not simply imagine a mask whose evolutionary of the Salt was fixed at
the start (why not from the handshake key) and whose encryption evolve based
on the contents of the frames?

I would be really pleased that you explain on that!

Thank you very much because I truly believe that WebSockets are a priority
in the future of dynamic web apps :-)

Sincerely,

-

Jean-Christophe Bos,

CEO, Tenactys Group

0 820 620 118
06 80 27 93 84

 <mailto:[email-masked]> [email-masked]

---

From: Anthony Catel <[email-masked]>
Date: Thu, 09 Jun 2011 18:37:25 +0200

Hi,

It's mainly because of proxy traversal (please read previous discussions 
about cache poisoning & co)

Anthony Catel

Le 09/06/2011 17:13, Jean-Christophe Bos a écrit :
>
> Hello everyone,
>
> I wanted to ask you (from France!) about the latest WebSocket's drafts 
> that I also fully implemented in my own HTTP server (since hixie 76).
>
> On the masked frames, you mentioned earlier, that the mask must be 
> selected by an high entropy but it seemed illusive.
>
> However, you came back to say that just choose a random mask but 
> always in a logical of non-predictability.
>
> Why have won so much space on the data payload length and lose 
> unnecessarily 32b for the masks contained in each frame?
>
> WebSockets is indeed a protocol over HTTP over TCP, thus ensuring a 
> good packets order and lossless.
>
> So why not simply imagine a mask whose evolutionary of the Salt was 
> fixed at the start (why not from the handshake key) and whose 
> encryption evolve based on the contents of the frames?
>
> Thank you very much because I truly believe that WebSockets are a 
> priority in the future of dynamic web apps :-)
>
> Sincerely,
>
> **
>
> *-*
>
> *Jean-Christophe Bos*,
>
> CEO, Tenactys Group
>
> 0 820 620 118
> 06 80 27 93 84
>
> [email-masked] <mailto:[email-masked]>
>
>
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi

---

From: Joel Martin <[email-masked]>
Date: Thu, 9 Jun 2011 17:47:19 -0400

> unnecessarily 32b for the masks contained in each frame?

It is worth noting that the masking is only in the client -> server
direction.

Joel Martin

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Sat, 11 Jun 2011 08:10:28 +0200

IMHO this doesn't answer the original question:

> So why not simply imagine a mask whose evolutionary of the Salt was fixed at the start (why not from the handshake key) and whose encryption evolve based on the contents of the frames?

The author of the thread is not suggesting removing the client->server
masking, but just make it predictable (for example from the WS
handshake data) rather than having each frame its own masking key.
Would be any (security) issue in the suggested case? I don't think so,
but just wondering.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Willy Tarreau <[email-masked]>
Date: Sat, 11 Jun 2011 08:15:14 +0200

> Would be any (security) issue in the suggested case? I don't think so,

This was discussed in great detail in the past (as everything around masking).
The issue if the mask doesn't change is that the server knows it, so if it is
running malicious code (and so does the client), then it can tell the mask to
the client which will be able to emit predicted contents over the wire. So the
mask must change between two exchanges so that the client cannot guess it.

Willy

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Sat, 11 Jun 2011 08:26:53 +0200

> mask must change between two exchanges so that the client cannot guess it.

Clear now. Thanks.

-- 
Iñaki Baz Castillo
<[email-masked]>