Re: [hybi] More on Payload Masking

[John Tamplin <[e-mail]>]

On Thu, Nov 11, 2010 at 2:15 PM, Zhong Yu <[e-mail]> wrote:
>> Unless you can produce a particular encrypted counter value, the
>> presence of XOR doesn't change the unforgeability.
>
> I assume we need a new counter for each WS frame?

No, as it the encrypted counter is not predictable.

> Isn't it equivalent, but simpler, if each WS frame payload is XOR-ed
> by a random 128 bits mask. The mask is different from frame to frame,
> generated by the sender, and carried within the frame.

The point was that if the attacker knows the key, they can trivially
produce arbitrary data after masking.  If the UI chose a new random
key for every frame, I think that would solve it but now we just added
16 bytes per frame after we worked so hard to keep the frame sizes
down.

If we are going to go that route, I would prefer to just say WebSocket
doesn't support unencrypted connections (given the growing attacks
against unencrypted connections maybe it isnt a bad idea anyway).

-- 
John A. Tamplin
Software Engineer (GWT), Google