Re: [hybi] why did rfc6455 choose the 16-byte sec_websocket_key

[John Tamplin <[e-mail]>]

On Mon, Feb 27, 2012 at 9:38 AM, Juan Li <[e-mail]> wrote:

> What kind of security implications? eg., how do that kind of security
> problems happen?
>

The probability of guessing the key is inversely proportional to the number
of possible keys.

The primary point is to make sure that the server actually speaks the
WebSocket protocol, so the security implication would be allowing an
attacker to use a WebSocket client (which will run in every browser and be
able to connect to any server, since it is not subject to same-origin
policy) to attack a non-WebSocket server if he can somehow trick the client
into thinking it is a WebSocket server.  A smaller key would increase the
probability of generating a collision in the Sec-WebSocket-Accept, which
means a server that can be made to echo back attacker-controlled values but
which does not implement the WebSocket handshake could be made to pass the
handshake anyway.

Again, this happens once per connection, so the size isn't a significant
concern.

-- 
John A. Tamplin
Software Engineer (GWT), Google