Re: [hybi] Straw-poll on Masking options

[Adam Barth <[e-mail]>]

On Wed, Jan 12, 2011 at 12:00 PM, Salvatore Loreto
<[e-mail]> wrote:
> Hi all,
>
> Masking from the client to the server
> has reached strong consensus within this wg as a mechanism to reduce
> security risks.
>
> However there is disagreement on the actual method for masking.
> The technical differences, pro and cons, advantages and disadvantages,
> as well as the legal implications of each method have already been deeply
> discussed.
>
> In order to settle the question of masking and find a way forward that has a
> wide acceptance,
> Joe and I, as HyBi chairs, want to check where the consensus is
> on the following relevant options that have been discussed (and summarized
> at
> some point in the mailing list by Eric Rescorla)
>
> 1. a fixed mask carried entirely in the packet.
>
> 2. A longish repeated mask computed from the packet. For concreteness,
>   suppose HMAC-SHA1(<uuid>, <server-conn-key> || <client-conn-key> ||
> <packet-key>), but
>   obviously there's flexibility here.

This option is ok, but less than ideal.

> 3. A fully generated mask (if so specify also what you would like to use
> e.g. AES-CTR or HMAC-SHA).

This is the best option.

> Please indicate your preference(s) or the one can meet your bar for "I could
> live with that";
> In the case you have more then one, please put the choices in a preference
> order.
>
> This poll will run until January 18th.
>
> cheers
> /Sal
>
> --
> Salvatore Loreto
> www.sloreto.com
>
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi
>