3 ms·

Text-based protocols are simple for humans to read, but anything requiring parsing is a security smell. Even if you are sure your buffer handling is free of bu

Text-based protocols are simple for humans to read, but anything requiring parsing is a security smell. Even if you are sure your buffer handling is free of bugs (reasonable in new languages, but the known-size of binary fields has been a security strength for them), the ambiguity of text is dangerous. Interpreting as text easily corrupts binary embeds if you aren't careful, and escaping bloats the size of what's already the largest part of your message. Many security bugs have been triggered by implementations disagreeing about when they interpret UTF-8 and when they don't. UTF-8-encoded ASCII characters, for example, may cause one parser to recognize a keyword that another ignores; nevermind different sets of accepted whitespace characters. You could define a very-strict encoding and delimination scheme, but at that point you can't trust text editors to edit it- making it effectively a needlessly-complicated binary protocol.

atemerev 10y ago
Well, OpenPGP works, and it is not terribly complicated. But yes, UTF-8 is a huge can of worms. (An accepted solution for this problem is obligatory "canonicalization" step - transforming the message into agreed canonical format before transmitting it. Still viewable and editable by text editors, no need to worry about parsing errors. Canonicalization step can still be error-prone, but the attack surface is much less than every possible parser in the world.)
zokier 10y ago
> Text-based protocols are simple for humans to read, but anything requiring parsing is a security smell. Any protocol requires parsing, binary or not.
atemerev 10y ago
Also, some sort of "parsing" (normalizing) is always required even for binary messages. Endianness, alignment conventions, etc. — just mapping the network bytes onto memory is inviting trouble. (btw, network byte order is big-endian).
- tangent128 10y ago
  Point, though binary normalization is easier to define in a manner everybody will consistently implement as opposed to, say, SMTP headers. ...I guess it's abominations like SMTP that I mainly think of when I hear "text-based protocol". JSON and bencode are probably safe enough. (Canonicalization is not useful from a security perspective, since an attacker is under no obligation to canonicalize their message.)

atemerev 10y ago

Well, OpenPGP works, and it is not terribly complicated. But yes, UTF-8 is a huge can of worms. (An accepted solution for this problem is obligatory "canonicalization" step - transforming the message into agreed canonical format before transmitting it. Still viewable and editable by text editors, no need to worry about parsing errors. Canonicalization step can still be error-prone, but the attack surface is much less than every possible parser in the world.)

zokier 10y ago

> Text-based protocols are simple for humans to read, but anything requiring parsing is a security smell. Any protocol requires parsing, binary or not.

atemerev 10y ago

Also, some sort of "parsing" (normalizing) is always required even for binary messages. Endianness, alignment conventions, etc. — just mapping the network bytes onto memory is inviting trouble. (btw, network byte order is big-endian).

tangent128 10y ago
Point, though binary normalization is easier to define in a manner everybody will consistently implement as opposed to, say, SMTP headers. ...I guess it's abominations like SMTP that I mainly think of when I hear "text-based protocol". JSON and bencode are probably safe enough. (Canonicalization is not useful from a security perspective, since an attacker is under no obligation to canonicalize their message.)