Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Tobias Oberstein <[e-mail]>]

I think we've talked past one another: yes, in the browser, JS can't tamper with the masking,
by being restricted to do so.

What I meant was non-browser clients using a WS implementation that have an option
to "fake masking": turn on mask bit, insert mask, but don't actually mask.

That would only work if the server peer knows that masking is fake, and likely only
for binary messages. For example announcing: subprotocol "fakemask-safecpu"

An for that case: the presence of a mask (the 4 octets) plus mask bit set is not sufficient
for an intermediary to know that the payload is actually masked and detect the faking.

A masking scheme that i.e. requires the mask to be the first 4 bytes of the SHA1 computed
over the frame payload would have made that impossible, and intermediaries could actually
proof that frames are really masked. Unmask, recompute SHA1 over frame payload and
compare to mask. Very hard to fake. But I'm certainly NOT advocating anything like that.
It would break streaming i.e. - I'm fine with the current stuff.


Von: John Tamplin [mailto:[e-mail]]
Gesendet: Donnerstag, 8. September 2011 19:48
An: Tobias Oberstein
Cc: Peter Saint-Andre; Richard L. Barnes; [e-mail]
Betreff: Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

On Thu, Sep 8, 2011 at 1:04 PM, Tobias Oberstein <[e-mail]<mailto:[e-mail]>> wrote:
A client can just send frames with mask bit set, a random mask, but don't actually mask (XOR) the payload.

The intermediary can check for mask bit set, unmask the payload using the random mask,
and then?

When a client send white noise as payload, XORing the white noise with any mask will not
change the statistics of the result vs the original.

Same for any sane encryption, which looks like white noise after encryption, and will look
like white noise after XOR with _any_ mask

How can an intermediary proof that payload is really masked?

It knows the payload is really masked because a mask was present.  Obviously, it can't know whether the payload was chosen to produce some value after masking (any more than it could know why any particular payload was chosen), but the browsers enforce that by not letting the JS code control the key.

--
John A. Tamplin
Software Engineer (GWT), Google