Re: [Jmap] Benjamin Kaduk's Discuss on draft-ietf-jmap-websocket-04: (with DISCUSS and COMMENT)

[Ken Murchison <[e-mail]>]

Hi Benjamin,

Thank you very much for the detailed review.  I believe that I have 
addressed all of your points in my forthcoming draft, except the one below.


On 1/7/20 4:08 PM, Benjamin Kaduk via Datatracker wrote:
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> The discussion of compression bears some closer scrutiny, as if we allow
> the entire websocket frame to be part of the compression state,
> then there may be more avenues for an attacker to inject content into
> the same compression state as data that we want to keep somewhat
> confidential.  (This is not as bad as, say, the initial CRIME attack
> impact, as the authentication credentials are not being repeatedly sent,
> but the general principle of mixing attacker-controlled and confidential
> data into the same compression domain is the same.)
>
> We could say something in the security considerations about the
> potential consequences for a client that sends multiple requests in
> parallel without request IDs and gets back responses in a different
> order.  (Or just require unique request IDs, I suppose.)


Can you expand on this?  I'm not sure I fully understand the exploit or 
the way(s) to mitigate it.


-- 
Kenneth Murchison
Cyrus Development Team
FastMail US LLC