[hybi] Summary of issues concerning the default masking algorithm

[Bruce Atherton <[e-mail]>]

Now that masking is officially going to be part of the protocol, I for 
one would find it useful to have all the concerns of the masking 
algorithm in one place to make it easier to reason about. I realize that 
much of this has already been discussed in various threads in all kinds 
of messages and that some (though I do not think all) consider the 
decisions on the algorithm pretty much made, but I think it would be 
easier to reason about and be certain we have consensus on them if the 
information could be gathered in a single thread.

Here is my understanding of the current state of issues around the 
masking algorithm. Please feel free to correct me or add more information.

The problems masking is intended to address are:

   1) to prevent an attacker from using a browser to initiate a 
Websocket connection to a vulnerable intermediary or non-Websocket 
server that can be exploited by sending apparent HTTP or elements of 
other protocols in a Websocket frame

and more controversially:

   2) to prevent an attacker from using a browser to open a cross-site 
scripting HTTP connection that emulates a Websocket connection

   3) to prevent potential unknown future attacks using a browser with a 
Websocket connection that can be avoided by disallowing an attacker's 
control of bits on the wire

If there are other problems masking is seen as a solution for, please 
add them. Those are the ones I am aware of.

The most basic masking suggestion I have seen is to provide a per-frame 
random mask that is sent with the frame and XORed with the contents.

The features which have been suggested to enhance this scheme that I 
know of are:

a) The client nonce should influence the mask

b) The server nonce should influence the mask

c) The mask should be kept off the wire by generating the mask using a 
shared secret
   - This means replacing the per-frame mask with a per-frame key used 
in generating the mask
   - the shared secret that has been suggested is a connection key 
generated from the client and server nonce, thus including features a and b

d) The attacker should not only be prevented from controlling the bits, 
but also the pattern of bits

Again there may be other features that have been suggested but those are 
the ones I am aware of.

I'll leave it to the advocates of each of these features to summarize 
the benefits of them that justify their costs, as I don't think I could 
do justice to them. I can make a stab at the costs, though.

For feature a, the only cost I can see is in the increase in complexity 
in generating the mask.

For feature b, there is the increase in complexity in generating the 
mask as well as the fact that you can not send a payload with the 
initial handshake from the client because you do not yet have the server 
nonce.

The principal cost of feature c that I can see is that it stops tools 
like wireshark from being able to decode streams.

The cost of feature d is increased complexity in implementation and 
added computational cost.

Feel free to add to or argue with any of these points. I've tried to 
state things as neutrally as I can.