[Webpush] ietf-webpush-encryption - untrusted push services

[Peter Beverloo <[e-mail]>]

We don't trust the intermediary. What if they are the attacker?

    (1) There's a possibility of contributory behaviour with other DH
groups.

E.g. using an ephemeral key of 0 (or 1) forcing the shared key to be zero,
or using one of the 12 "forbidden" Curve25519 values.

Since P-256 is a prime-ordered group this doesn't apply today, but it would
be a subtle issue if we were to change curves.

    (2) The client is vulnerable to DoS attacks.

Authentication only happens while deciphering the payload with the
calculated content encryption key, which can be a heavy operation for
lower-end devices. Being able to authenticate the message before doing
public key operations would mitigate this.


One option is for the UA to create a HMAC key per subscription, which it
will transfer to the application server, together with the public key, upon
creating a subscription.

The application server will then HMAC the whole message -including the
ephemeral key- before sending it to the push service. This mitigates both
concerns.

Thanks,
Peter