Re: [hybi] Insight you need to know: Browsers are at fault when servers crash

[Willy Tarreau <[e-mail]>]

On Mon, Jul 26, 2010 at 11:11:54AM +0200, Roderick Baier wrote:
> Willy Tarreau schrieb:
> >This principle sounds good, and in my opinion would be compatible with
> >Greg's proposal of putting the nonce in a request header. Basically the
> >client chooses a random key, advertises it as a nonce and can start
> >sending data encrypted with that key. It must then check once the server
> >responds that the hash of the key that confirms its will to use it
> >for all data past the headers.
> >
> >Willy
> >
> 
> So you want to encrypt the data with a key which was transmitted without 
> encryption? Did I get you right?

yes, the principle of this "encryption" here is not to provide any
confidentiality but only to scramble the data in a way not controllable
by the client, so that it cannot send arbitrary bytes after the handshake.

And you make me think that we'd better talk about scrambling than
encryption to avoid any mis-understanding resulting in a misuse.

Willy