Subject: [hybi] Simple payload masking

From: Paul Colomiets <[email-masked]>
Date: Tue, 21 Dec 2010 06:29:29 +0200

21.12.2010, 05:33, "Bjoern Hoehrmann" <[email-masked]>;:

>  * Paul Colomiets wrote:
>>  Then I propose to add a single byte payload mask at start of each
>>  packet. Then each byte in packet will be XORed with mask byte.
>>  It will be much simpler to implement and will use less cpu than
>>  AES encryption.
>  As far as masking goes, the security depends on the secrecy of the key
>  and the length of the key. As it has been proposed, AES is used only to
>  generate a keystream; applying it is simply a matter of XORing the
>  plaintext with the keystream. So long as the attacker cannot learn the
>  key and adapt the data he is sending to it, it does not matter how the
>  key is generated, so if you do per-frame masking there is no need to use
>  AES. What you do need is more key data than a single byte as otherwise
>  brute force attacks would be possible. (For arbitraty data that is, for
>  plain text there are indeed other options).

But there is a TLS for security. The only thing this protocol should do is
don't look like HTTP. So I really think that AES encryption would be a
problem for protocol adoption. Not only because CPU needed, but also
because of need of using some big library (e.g. openssl) for it.

So maybe we have some options for allowing plain-text connections
without encryption:
 (1) allow plain-text messages some simple masking like described
above, or some other simple method (maybe escaping CR LF ?)
before we exchanged hello messages, like described following paper
(but applying that not for 7-bit data but UTF-8 data):
http://www.ietf.org/mail-archive/web/hybi/current/msg05233.html
 (2) allow binary messages only with TLS enabled
 (3) make binary messages extension, which needs AES encryption
and a like

3-rd option also allows to make next specification secure but text-only,
and after that we could design binary. Sorry, probably it were discussed
before, but there are plenty of use cases for text websockets. And
even if you really need binary data you can either (base64) encode it,
or send a notification and download data using regular HTTP.

--
Paul

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 20 Dec 2010 20:57:45 -0800

2010/12/20 Paul Colomiets <[email-masked]>

> because of need of using some big library (e.g. openssl) for it.
The amount of CPU needed is marginal. You don't need anything anywhere near
as heavyweight code size wise as OpenSSL to just get AES, and of course
the primary target environment (browsers), already has an AES impl.

-Ekr