Re: [hybi] Handshake was: The WebSocket protocol issues.

[Ian Hickson <[e-mail]>]

On Sun, 26 Sep 2010, Adam Barth wrote:
>
> Your email appears to proceed from the assumption that the current 
> handshake is sufficiently robust to cross-protocol attacks.  That might 
> well be true.  However, I don't think we have any reasonable assurance 
> that it is true.  If we can't have reasonable assurance of the security 
> of the -76 handshake, then we certainly cannot have such assurance about 
> your handshake since it is strictly weaker.
> 
> On the other hand, we can be reasonably assured that the TLS+NPN 
> handshake resists cross-protocol attacks.  I provided a security 
> argument to that effect in an email a while ago.  No one has provided a 
> similarly detailed security analysis of the -76 handshake or of the 
> handshake that you propose.

As the designer of the "-76 handshake", I can confirm that while I am not 
aware of any attacks against it, and while it was designed to withstand 
all the attacks I knew of and to be resilient against the most obvious 
implementation errors, it is certainly not proven beyond a doubt that it 
is secure against anything that might be thrown at it.

As it stands, the handshake was a compromise between the competing needs 
of security in depth, fast time-to-market, and triviality of 
implementation. Since the latter two constraints are no longer as 
pressing, IMHO we should dial up the effort on the first. We can certainly 
do a much better job of having a handshake immune to current and future 
threats if we can take longer to do it and/or if we can do things that 
only have to be implemented a few times by more experienced engineers 
(e.g. if we can rely on crypto-level features like TLS).

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'