[hybi] Connection-level extensions

[Bjoern Hoehrmann <[e-mail]>]

Hi,

  I gather from the threads on how masking makes the deflate-stream ex-
tension perform much worse that the extension is essentially a deflate-
tunnel that wraps around the Websocket frames. I am not sure people are
aware this kind of extension is even possible and there are problems
with them, for instance, the current draft does not really mention this
as a possibility and you can't write intermediaries that need to under-
stand parts of the protocol without having to upgrade them for each new
extension.

For `deflate-stream` in particular it's not even very useful to work in
this manner due to masking, and since masking does not actually random-
ize the content that is sent, it would also seem to defeat masking. De-
flation compresses by replacing repeated sequences with references, and
the chosen masking scheme allows attackers to produce repeated sequences
so it may be quite possible to generate messages deflation turns into a
desired sequence of bytes, if the deflate implementation is predictable.

It seems odd to me that everybody is okay with having connection-level
extensions at all, and having the `deflate-stream` extension designed in
this manner in particular. In any case, this should be mentioned promi-
nently in the specification.

regards,
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/