IETF Logo Mail Archive

Re: [hybi] Handshake was: The WebSocket protocol issues.

Adam Barth <ietf@adambarth.com> Sat, 02 October 2010 21:51 UTC

Return-Path: <ietf@adambarth.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D12E73A6D87 for <hybi@core3.amsl.com>; Sat, 2 Oct 2010 14:51:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.007
X-Spam-Level:
X-Spam-Status: No, score=-2.007 tagged_above=-999 required=5 tests=[AWL=-0.030, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y9eLzlkgis2v for <hybi@core3.amsl.com>; Sat, 2 Oct 2010 14:51:34 -0700 (PDT)
Received: from mail-qy0-f179.google.com (mail-qy0-f179.google.com [209.85.216.179]) by core3.amsl.com (Postfix) with ESMTP id DCC973A6D4F for <hybi@ietf.org>; Sat, 2 Oct 2010 14:51:33 -0700 (PDT)
Received: by qyk8 with SMTP id 8so76532qyk.10 for <hybi@ietf.org>; Sat, 02 Oct 2010 14:52:25 -0700 (PDT)
Received: by 10.229.2.7 with SMTP id 7mr5245908qch.277.1286056344492; Sat, 02 Oct 2010 14:52:24 -0700 (PDT)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by mx.google.com with ESMTPS id t1sm3182555qcs.9.2010.10.02.14.52.23 (version=SSLv3 cipher=RC4-MD5); Sat, 02 Oct 2010 14:52:23 -0700 (PDT)
Received: by iwn3 with SMTP id 3so6348114iwn.31 for <hybi@ietf.org>; Sat, 02 Oct 2010 14:52:22 -0700 (PDT)
Received: by 10.231.157.135 with SMTP id b7mr7755886ibx.164.1286056342223; Sat, 02 Oct 2010 14:52:22 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.231.149.20 with HTTP; Sat, 2 Oct 2010 14:51:52 -0700 (PDT)
In-Reply-To: <4CA772A1.2090808@caucho.com>
References: <AANLkTikszM0pVE-0dpZ2kv=i=y5yzS2ekeyZxtz9N=fQ@mail.gmail.com> <4CA12810.8020006@caucho.com> <AANLkTimrMfXrnVMjU3f57L_sO7usyYQ56rBM4aMb2Pfr@mail.gmail.com> <20100928052501.GD12373@1wt.eu> <CA8029B0-71A3-44ED-88C6-934FE833BBA2@apple.com> <AANLkTim+fXj-h6OS3OdcfVfh3Q1UwxD8NLVawb=AWHX+@mail.gmail.com> <4FAC5C93-9BDF-4752-AFBC-162D718397AB@apple.com> <AANLkTikcH1W3bQwumqHbe-Yqa3XdoJqCa2b-mZuvoQ7g@mail.gmail.com> <9746E847-DC8B-45A7-ADF3-2ADB9DA7F82E@apple.com> <AANLkTik9igUwoxVrktoBoZrPoUW=Tjh7HyVbGJgQYes-@mail.gmail.com> <9F595226-FA0A-4C38-A6D0-0F4214BD7D21@apple.com> <4CA4BE10.1010709@caucho.com> <AANLkTi=wKFnNOuM+U3fktAFRn3R5OZ7c6PR2W3EAy7tm@mail.gmail.com> <4CA53E6B.1040808@caucho.com> <AANLkTikOyvF5AHTf4sDD=rWmK2FTD6R6LaHa4KTqkbcm@mail.gmail.com> <4CA68098.8010404@caucho.com> <AANLkTinYhW9MnnM3tkbCWziePyM7mFUEteKhw5OGp-eS@mail.gmail.com> <AANLkTi=_ejOCNiM49VW5q05=H7-M0jzAvXvGaKM1b7mX@mail.gmail.com> <AANLkTimyJj+Jxz1Q6fLrQ8iosGkD+0shUh3=td+jX_Do@mail.gmail.com> <4CA772A1.2090808@caucho.com>
From: Adam Barth <ietf@adambarth.com>
Date: Sat, 02 Oct 2010 14:51:52 -0700
Message-ID: <AANLkTi=nLixtxMEd4B58Zp5FRbquNX2C_=7gCf9BGGQs@mail.gmail.com>
To: Scott Ferguson <ferg@caucho.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] Handshake was: The WebSocket protocol issues.
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 02 Oct 2010 21:51:35 -0000

On Sat, Oct 2, 2010 at 10:57 AM, Scott Ferguson <ferg@caucho.com> wrote:
> Your DNS example did not weaken requirement #1, because it didn't identify a
> server or proxy that could calculate the hash. Your "relay back" either used
> the browser itself as a websocket proxy or it meant time travel.

I'm not sure you understood the DNS example correctly.  The forged DNS
request is for foo.attacker.com, which means the nonce is sent to the
attacker's DNS server.  The attacker's DNS server can easily compute
the HMAC and send it back in a DNS response.  The HMAC will then get
relayed through the DNS and returned to the browser.

Adam

v2.23.0 | Report a Bug | By Email