Re: [hybi] Experiment comparing Upgrade and CONNECT handshakes

[Adam Barth <[e-mail]>]

2010/11/27 Ian Fette (イアンフェッティ) <[e-mail]>:
> On Sat, Nov 27, 2010 at 8:24 AM, Adam Barth <[e-mail]> wrote:
>> On Sat, Nov 27, 2010 at 8:16 AM, Willy Tarreau <[e-mail]> wrote:
>> > On Sat, Nov 27, 2010 at 07:51:17AM -0800, Eric Rescorla wrote:
>> >> What's the argument *for* having an insecure handshake?
>> >
>> > There's no argument *for* having an insecure handshake, there are
>> > arguments
>> > for having a safe HTTP-compliant handshake.
>>
>> The handshake we're proposing is both safe and HTTP compliant.
>
> I really appreciate all the work you and others have done with this paper. I
> have a few questions I'd like to ask if you wouldn't mind.
> #1, if we changed the non-bogus Host header to be the real host, do you
> believe that would have any substantial negative impact?

We didn't run that experiment, so I can't say for sure, but my
impression is that it would not have a substantial negative impact.
That mitigation is for the virtual hosting scenario where one virtual
host might accept the handshake on behalf of the whole physical host.
These attacks are, of course, much more expensive to mount than the
attacks described in the paper, which are quite cheap.

> #2 Is there anything else that is in the handshake proposal that is perhaps
> HTTP compliant by the letter but not the spirit? (Other than CONNECT vs
> UPGRADE -- I think you've made that case.)
> I personally don't care strongly enough about the above to call them a
> requirement, but a number of people on this list have raised the HTTP compat
> issue so I would like to better understand what that would imply with the
> proposal this paper suggests the group move forward with.

We've moved some of the bits around since the first draft to make the
handshake HTTP compliant.  For example, we used to send the metadata
in the entity body, but HTTP forbids CONNECT requests from having an
entity body, so we now send the data in a header.  I don't know of
anything in the current proposal that violates HTTP.  If folks point
out specific aspects they believe are in violation, I'm sure we can
find a way to fix them.

Adam