Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> I brought up the example of DNS to show how an attacker might be able
> to get a non-WebSocket server to rely the c-nonce to the attacker and
> let the attacker relay back with the HMAC of the c-nonce.  This
> example might not completely break the c-nonce handshake, but it's
> evidence that relying upon an HMAC alone is probably unwise.
>   

Let's focus on this point.

To successfully attack the nonce/hash, the hijacker must do all of the 
following:

  1) Find a server or proxy (or sequence of proxies) that calculates H(x,y)
  2) Extract c-nonce from the request bytes and inject it into x.
  3) Inject "WebSocket" into the request and inject into y.
  4) Induce the server/proxy to return/forward the calculated hash in 
the proper format.

To keep the discussion focused on #1, lets give the hijacker 2-4.

There are two restrictions however:

  a) The hijacker can't use a websocket proxy.
  b) No time travel allowed.

Your DNS example did not weaken requirement #1, because it didn't 
identify a server or proxy that could calculate the hash. Your "relay 
back" either used the browser itself as a websocket proxy or it meant 
time travel.

-- Scott
> Adam
>
>
>
>