Re: [hybi] Straw-poll on Masking options

[Scott Ferguson <[e-mail]>]

Salvatore Loreto wrote:
> Hi all,
>
>
> Masking from the client to the server
> has reached strong consensus within this wg as a mechanism to reduce 
> security risks.

Well, more like acceptable overkill to achieve consensus.

>
> 1. a fixed mask carried entirely in the packet.
>

This is fine.

> 2. A longish repeated mask computed from the packet. For concreteness,
>    suppose HMAC-SHA1(<uuid>, <server-conn-key> || <client-conn-key> || 
> <packet-key>), but
>    obviously there's flexibility here.
>
> 3. A fully generated mask (if so specify also what you would like to 
> use e.g. AES-CTR or HMAC-SHA).

These add no actual security value for this issue.

-- Scott