IETF Logo Mail Archive

Re: [hybi] Websocket over TLS keep-alive overhead

<Markus.Isomaki@nokia.com> Fri, 07 December 2012 09:40 UTC

Return-Path: <Markus.Isomaki@nokia.com>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77DE021F890D for <hybi@ietfa.amsl.com>; Fri, 7 Dec 2012 01:40:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I6jtmer2r2ZT for <hybi@ietfa.amsl.com>; Fri, 7 Dec 2012 01:40:43 -0800 (PST)
Received: from mgw-sa01.nokia.com (smtp.nokia.com [147.243.1.47]) by ietfa.amsl.com (Postfix) with ESMTP id 9A77621F8906 for <hybi@ietf.org>; Fri, 7 Dec 2012 01:40:42 -0800 (PST)
Received: from vaebh106.NOE.Nokia.com (in-mx.nokia.com [10.160.244.32]) by mgw-sa01.nokia.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id qB79ea8c009040; Fri, 7 Dec 2012 11:40:37 +0200
Received: from smtp.mgd.nokia.com ([65.54.30.23]) by vaebh106.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Fri, 7 Dec 2012 11:40:36 +0200
Received: from 008-AM1MPN1-041.mgdnok.nokia.com ([169.254.1.185]) by 008-AM1MMR1-007.mgdnok.nokia.com ([65.54.30.23]) with mapi id 14.02.0318.003; Fri, 7 Dec 2012 09:40:35 +0000
From: Markus.Isomaki@nokia.com
To: jamie@shareable.org, tyoshino@google.com
Thread-Topic: [hybi] Websocket over TLS keep-alive overhead
Thread-Index: Ac3JZhTrqgN5+FAiRC2vlGrsEjKGjQACz0aQASIn74AAB/kDAAGQDuNA
Date: Fri, 07 Dec 2012 09:40:34 +0000
Message-ID: <E44893DD4E290745BB608EB23FDDB762328B43@008-AM1MPN1-041.mgdnok.nokia.com>
References: <E44893DD4E290745BB608EB23FDDB762317CFF@008-AM1MPN1-042.mgdnok.nokia.com> <634914A010D0B943A035D226786325D4339290CD54@EXVMBX020-12.exch020.serverdata.net> <CAH9hSJYm3Ucynuumd7iMO8Cw3use1BKBi2MTpybecuS1Si7caA@mail.gmail.com> <20121129101102.GA17793@jl-vm1.vm.bytemark.co.uk>
In-Reply-To: <20121129101102.GA17793@jl-vm1.vm.bytemark.co.uk>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.21.81.91]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginalArrivalTime: 07 Dec 2012 09:40:36.0681 (UTC) FILETIME=[E91FEB90:01CDD45E]
X-Nokia-AV: Clean
Cc: hybi@ietf.org
Subject: Re: [hybi] Websocket over TLS keep-alive overhead
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Dec 2012 09:40:43 -0000

Hi,

Yes, these are all very good points. Just one comment.

Jamie Lokier wrote:
>
>(Of course over mobile links, it would make much more sense for power
>efficiency to have a single, aggregated keepalive stream for all sockets rather
>than one per active websocket, or some other way of taking advantage of the
>phone's existing mobile link-level keepalives which it already does and are
>designed for efficiency.)

Yes, aggregation is very important. If the keep-alive streams are independent, power consumption is typically also multiplied. But I'm not sure what type of "link-level" keep-alives you are thinking about. In both cellular and Wi-Fi links there is some messaging/paging going on, but that is typically in the timescale of hundreds of milliseconds. So, it's not relevant to TCP or websocket level keep-alives. However, synchronizing keep-alives with any other IP traffic the device sends/receives is useful.

Markus

>-----Original Message-----
>From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
>ext Jamie Lokier
>Sent: 29 November, 2012 12:11
>To: Takeshi Yoshino
>Cc: hybi@ietf.org
>Subject: Re: [hybi] Websocket over TLS keep-alive overhead
>
>Takeshi Yoshino wrote:
>>    Hi,
>>    Chromium is using 1/n-1 record splitting for TLS 1.0 connection w/ CBC
>>    mode cipher to work around BEAST exploit. So, even a WebSocket frame
>>    with 1 octet payload (client -> server, 7 octets in total. AES block
>>    size (16) * 2 - SHA1 HMAC size (20) - padding length field size (1) >
>>    7, so 1 application data record with 32 octets payload is enough) will
>>    be packed into two TLS records with big padding.
>>    re: TLS compression, it's disabled on Chromium to address another
>>    exploit called CRIME.
>
>It might make sense if TLS could transmit its own, much shorter, keepalive
>messages, which are for the sole purpose of keeping the link alive.  I would
>guess, since they have no other effect, that they wouldn't be exploitable in
>the same way.  Is that right?
>
>It would be best if they could be invoked from the higher layer rather than
>generated in TLS itself (because the higher layer will have a better idea of the
>keepalive patterns that it needs), and if they were one-way keepalives rather
>than PING/PONG to avoid amplification attacks, and because PING/PONG is
>not the most efficient keepalive pattern.
>
>Is there provision in TLS for that sort of thing now?
>
>(Of course over mobile links, it would make much more sense for power
>efficiency to have a single, aggregated keepalive stream for all sockets rather
>than one per active websocket, or some other way of taking advantage of the
>phone's existing mobile link-level keepalives which it already does and are
>designed for efficiency.)
>
>-- Jamie
>_______________________________________________
>hybi mailing list
>hybi@ietf.org
>https://www.ietf.org/mailman/listinfo/hybi

v2.23.0 | Report a Bug | By Email