IETF Logo Mail Archive

Re: [hybi] Handshake was: The WebSocket protocol issues.

Maciej Stachowiak <mjs@apple.com> Tue, 28 September 2010 05:17 UTC

Return-Path: <mjs@apple.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A1BF63A6C34 for <hybi@core3.amsl.com>; Mon, 27 Sep 2010 22:17:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.482
X-Spam-Level:
X-Spam-Status: No, score=-105.482 tagged_above=-999 required=5 tests=[AWL=-1.334, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2E1wdnn0Jx05 for <hybi@core3.amsl.com>; Mon, 27 Sep 2010 22:17:11 -0700 (PDT)
Received: from mail-out4.apple.com (mail-out4.apple.com [17.254.13.23]) by core3.amsl.com (Postfix) with ESMTP id DB2963A6C1F for <hybi@ietf.org>; Mon, 27 Sep 2010 22:17:11 -0700 (PDT)
Received: from relay13.apple.com (relay13.apple.com [17.128.113.29]) by mail-out4.apple.com (Postfix) with ESMTP id 833A1B24CCA5 for <hybi@ietf.org>; Mon, 27 Sep 2010 22:17:52 -0700 (PDT)
X-AuditID: 1180711d-b7b8eae0000035ac-9e-4ca17a80c4af
Received: from elliott.apple.com (elliott.apple.com [17.151.62.13]) by relay13.apple.com (Apple SCV relay) with SMTP id 42.23.13740.08A71AC4; Mon, 27 Sep 2010 22:17:52 -0700 (PDT)
MIME-version: 1.0
Content-type: multipart/alternative; boundary="Boundary_(ID_0pWHYKd+hOrusz6tNqbhHg)"
Received: from [17.151.102.217] by elliott.apple.com (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008; 32bit)) with ESMTPSA id <0L9F00ADVYPROB20@elliott.apple.com> for hybi@ietf.org; Mon, 27 Sep 2010 22:17:52 -0700 (PDT)
From: Maciej Stachowiak <mjs@apple.com>
In-reply-to: <AANLkTikswPyW_02R8zkMTMywOdMJkjmEKsuq_KGKf0Yw@mail.gmail.com>
Date: Mon, 27 Sep 2010 22:17:51 -0700
Message-id: <6FB29297-FFD9-47DD-9173-15F37FE1FEE1@apple.com>
References: <AANLkTikszM0pVE-0dpZ2kv=i=y5yzS2ekeyZxtz9N=fQ@mail.gmail.com> <62B5CCE3-79AF-4F60-B3A0-5937C9D291D7@apple.com> <AANLkTikKc+4q_Q1+9uDo=ZpFF6S49i6vj2agZOGWVqKm@mail.gmail.com> <E2D38FF3-F1B9-4305-A7FC-A9690D2AEB4A@apple.com> <AANLkTikswPyW_02R8zkMTMywOdMJkjmEKsuq_KGKf0Yw@mail.gmail.com>
To: Alexander Voronin <alexander.voronin@gmail.com>
X-Mailer: Apple Mail (2.1081)
X-Brightmail-Tracker: AAAAAA==
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] Handshake was: The WebSocket protocol issues.
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Sep 2010 05:17:14 -0000

On Sep 27, 2010, at 12:15 AM, Alexander Voronin wrote:

> Well that's what I've talked about. You have proposed simple and clear handshake that 100% protects handshake state of WebSocket connection and as result makes unable to use cross-protocol attacks. It's enough. Why this handshake was turned to something unimaginably complex? All this new steps do not protect nothing.

After learning more about the problem space, I think my original proposal, as well as the more complex version in the -76 draft, as well as Greg's re-simplified version, are probably not strong enough.

I do think Ian's version is a tiny bit stronger than my original proposal, but I think Greg's version is no stronger than my original.

Regards,
Maciej

> 
> 27 сентября 2010 г. 3:44 пользователь Maciej Stachowiak <mjs@apple.com> написал:
> 
> Here is an email from February where I summarized some of the risks from cross-protocol attacks for WebSocket:
> 
> http://www.ietf.org/mail-archive/web/hybi/current/msg01198.html
> 
>

v2.23.0 | Report a Bug | By Email