Subject: Re: [hybi] Straw Poll: is Upgrade with client->sever XOR mask acceptable?

From: Zhong Yu <[email-masked]>
Date: Thu, 23 Dec 2010 06:22:31 -0600

Nay. I do not accept the masking idea, there is no good reason for it,
and there lacks proof that it works as intended.

1. False is the statement that "GET+Upgrade handshake without masking
is demonstably un-safe by experiment". There has been no experiment
that tested anything close to the -76 handshake. Adam's experiment
tested bytes that are indistinguishable from two valid back-to-back
http requests and found 8 problems in 50 thousand runs. If the
experiment tested the actual -76 handshake, I bet there will be 0
problems. Since the CONNECT handshake got the reputation of
"demonstrably safe" just because the experiment found 0 problems, then
we could say GET+Upgrade is "demonstrably safe" too.

Many people had raised the same point. Most stopped arguing in order
to reach for consensus. I was pigheaded and got Adam highly
offended[1]. Nonetheless I think it's necessary to put the point on
record for this poll.

2. Now, say without concrete reasons, we still want to scramble bits
anyway - who knows, maybe it'll help. The goal is that attackers
cannot choose bytes on the wire. Does the masking design actually
prevent attackers from doing that?

The previous design was trivially defeat-able, as I first pointed out
on this mailing list[2]. The design was quite naive and the flaw is
very basic.

The current design is also dubious.  An attacker can learn the
per-frame key before the whole frame is written by browser. If the
source data is binary, it's quite likely that the data is mutable - we
don't know for sure at this time since there is no standard in
javascript yet, but look around in other languages, data arrays are
usually mutable.

- Zhong Yu

[1] http://www.ietf.org/mail-archive/web/hybi/current/msg05170.html
[2] http://www.ietf.org/mail-archive/web/hybi/current/msg04690.html

---

From: Greg Wilkins <[email-masked]>
Date: Thu, 23 Dec 2010 13:57:51 +0100

On 23 December 2010 13:22, Zhong Yu <[email-masked]> wrote:
> Most stopped arguing in order
> to reach for consensus.

Zong,
ya gotta pick ya battles!

Not worth fighting over something that is only a little painful.. and
if made an extension would be even less painful.
Looking another way, everybody does not need to be convinced of the
100% goodness of every feature in the protocol. We just need accept
that some features will be more compelling to some than others and
make sure that there is no significant badness of the features we
don't like.      eg. I'm still not convinced that variable length
lengths are a great idea, but it costs me little so whatever.. some
people want them badly, so why be a roadblock.

> 2.

hmmm well if you think the original attack vector is unlikely to
succeed, then this one is even less likely.
You would need to send large content... but not so large that it got
fragmented (which each fragment having it's own key).
You would need to client to be using a gather write from userspace,
where I think anything less than the fragmentation boundary size is
likely going to be copied into kernel space as a single buffer
You need a really fast network so that the server can get the first
packet of a frame and send back the key before the complete frame had
been sent
You need multi-threaded javascript, so the client can receive the key
and modify the array that is in the process of being sent.
And you need the intermediary that is being attacked not to buffer the
data... which is unlikely considering these are caching proxies we are
concerned about.

If somebody could demonstrate such an attack, I think i'd give him my
credit card details for a day as reward for an incredible job!

cheers

---

From: Dave Cridland <[email-masked]>
Date: Thu, 23 Dec 2010 13:47:31 +0000

> credit card details for a day as reward for an incredible job!

Especially given that even if you control the bytes on the wire, you  
now have to find a proxy susceptible to the attack, and that  
particular monster has been looked for under 50,000 beds and not  
found.

Frankly, if you can demonstrate this attack, you probably *had* my  
credit card details already...

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 23 Dec 2010 07:50:38 -0800

On Thu, Dec 23, 2010 at 5:47 AM, Dave Cridland <[email-masked]> wrote:

> Especially given that even if you control the bytes on the wire, you now
> have to find a proxy susceptible to the attack, and that particular monster
> has been looked for under 50,000 beds and not found.
>

No. We're discussing the GET + Upgrade handshake, where we actually did find
at least
potentially vulnerable proxies.

-Ekr

Frankly, if you can demonstrate this attack, you probably *had* my credit
> card details already...
>
> Dave.
> --
> Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]<[email-masked]>
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>