Re: [hybi] A bit of pragmatism

[Bruce Atherton <[e-mail]>]

I apologize if I am being thick, but I still don't understand.

It is my understanding that the masking algorithms which have been 
previously suggested prevent the attacker from controlling the payload 
bits on the wire from within a browser using Websockets without the 
added burden of being cryptographically secure. I had thought that you 
were arguing that the attacker could still control patterns in the bits, 
but not the bits themselves. That seemed like a reasonable thing for the 
ws: scheme to allow, to me, since by design it is a lighter weight, less 
secure form of Websockets and there have never been any exploits that 
relied on that characteristic that anyone has mentioned so far. Now it 
sounds like you are arguing that an attacker can completely control the 
bits no matter what unless it is cryptographically secure.

I'm sure I'm missing something, but I haven't a clue what it is.

On 09/01/2011 2:16 PM, Eric Rescorla wrote:
> It's not a matter of random versus non-random. RC4 and AES-CTR without random IV
> (which is not a requirement of the standard) provide the attacker with
> complete control over
> the payload bits on the wire, beause he can predict the keystream.