Re: [hybi] Masking only Payload/Extension Data

[Andy Green <[e-mail]>]

On 03/09/2011 08:27 AM, Somebody in the thread at some point said:

Hi -

> Can someone please explain to me why this matters? Given that we went
> with a 32-bit mask included in the frame, and it's just xor, I'm really

It's not driven by complaints about the masking complexity.

> not sympathetic to arguments about "it's hard to unmask" etc. The only
> thing that I've heard that resonates at all is that you have to know
> which direction the connection is going, e.g. which is the client and
> which is the server, that said it seems like any proxy doing anything
> interesting would probably already know this?

Because it's a streamed protocol, one problem it creates is a snooper 
trying to perform frame sync on stuff coming out of a client can find a 
pathological situation as it is, it's literally a randomized stream with 
no structure at all that may not have any framing relationship to packet 
boundaries.  It's four random bytes then everything xor'd with random 
without let-up, there's nothing to grab hold of once it has started.

If the framing is left standing proud of the mask action, there is at 
least always framing structure in the stream to sync on.

Also although I am grateful for the choice you made of simply 4-byte 
mask compared to AES and other castles in the air, actually sticking a 
fixed 4-bytes on the front in one direction is kind of a hack protocol-wise.

If the framing is definitely the boss in this protocol, and not 
subordinate to the masking, then it will be possible to negotiate 
different masking schemes at handshake-time if that becomes desirable 
without changing intermediaries that don't care about payload but must 
watch the streams for control packets or whatever: the intermediaries 
can just obey framing rules even with no masking negotiated or ROT13 or 
whatever negotiated that they don't understand or care about, but now 
won't break on.

As mentioned one specific case of wanting to do the above is Toni 
Ruottu's where the browser emits server frames.  He can solve his 
quandry with just an extension then, changing masking rules without 
upsetting the framing rules and so allowing things that don't understand 
to not break.

-Andy