search

Rantanen / node-dtls

JavaScript DTLS implementation for Node.js
ISC License
58 stars 15 forks source link

Improve HelloVerifyRequest cookie generation to use something verifiable #5

Closed brycekahle closed 9 years ago

brycekahle commented 9 years ago

The RFC suggests (SHOULD) to base the cookie off a random secret and client parameters.

The DTLS server SHOULD generate cookies in such a way that they can be verified without retaining any per-client state on the server. One technique is to have a randomly generated secret and generate > cookies as:

Cookie = HMAC(Secret, Client-IP, Client-Parameters)

When the second ClientHello is received, the server can verify that the Cookie is valid and that the client can receive packets at the given IP address.

Rantanen commented 9 years ago

I'll fix this when I touch the sequence number. Unfortunately there's still a lot of low effort stuff just to get the handshake working quick instead of to get it working well.

Incoming message validation and sending proper faults is another large aspect that's severely lacking.