{"action":"created","issue":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/496","repository_url":"https://api.github.com/repos/shadowsocks/shadowsocks","labels_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/496/labels{/name}","comments_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/496/comments","events_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/496/events","html_url":"https://github.com/shadowsocks/shadowsocks/issues/496","id":128311647,"number":496,"title":"Proposal for protocol enhancement","user":{"login":"shinku721","id":16848676,"avatar_url":"https://avatars.githubusercontent.com/u/16848676?v=3","gravatar_id":"","url":"https://api.github.com/users/shinku721","html_url":"https://github.com/shinku721","followers_url":"https://api.github.com/users/shinku721/followers","following_url":"https://api.github.com/users/shinku721/following{/other_user}","gists_url":"https://api.github.com/users/shinku721/gists{/gist_id}","starred_url":"https://api.github.com/users/shinku721/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shinku721/subscriptions","organizations_url":"https://api.github.com/users/shinku721/orgs","repos_url":"https://api.github.com/users/shinku721/repos","events_url":"https://api.github.com/users/shinku721/events{/privacy}","received_events_url":"https://api.github.com/users/shinku721/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-01-23T07:30:17Z","updated_at":"2016-04-25T14:05:01Z","closed_at":null,"body":"加入One Time Auth后的协议基本能保证CCA安全（虽然我建议直接使用一些现在被广泛采用的authenticated encryption的方法），但是仍然不能避免通过replay attack来探测的方法。举个例子，如果通过流量特征分析认为某服务器接收到的请求A与随后发出的请求B特征上有强相似，时间也重合，则可以通过重放请求A并观察服务器是否会再次发出请求B来判断A是否是对B的代理请求。\r\n这里提出一种可能的防止replay attack以及类似的探测攻击的方法。\r\n一般而言，防止此类攻击都是服务器会先提出一个挑战（比如签名或mac一个随机消息），客户端完成这个挑战，再进行通信。然而这在shadowsocks的设计哲学上并不适用，因为这样会导致一个麻烦的握手，协议特征也会变多。\r\n参考[wiki](https://en.wikipedia.org/wiki/Replay_attack)页面提出的timestamping方法，结合google的authenticater两步验证的思路，我们可以使用一种TOTP：\r\n1. 客户端请求时取HMAC_SHA256(floor(timestamp/5000ms), somekey)的前4字节加入请求头部。\r\n2. 服务器验证时验证最近的三个可能的MAC_SHA256(floor(timestamp/5000ms), somekey)值（这样提供一定的允许误差），如果均不符合，则拒绝请求。\r\n这种方法要求服务端与客户端时间同步，可以通过公共的ntp服务器等等方法校准时间，手段很多就不展开了。\r\n在时间误差内的replay attack，可以通过记录一段时间内的iv，拒绝重复的iv来防范。\r\n这样，replay一个历史的请求就会被拒绝了。可以在日志里面警告这样的请求——这代表你的流量被他人记录了。\r\n"},"comment":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/comments/214344809","html_url":"https://github.com/shadowsocks/shadowsocks/issues/496#issuecomment-214344809","issue_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/496","id":214344809,"user":{"login":"shinku721","id":16848676,"avatar_url":"https://avatars.githubusercontent.com/u/16848676?v=3","gravatar_id":"","url":"https://api.github.com/users/shinku721","html_url":"https://github.com/shinku721","followers_url":"https://api.github.com/users/shinku721/followers","following_url":"https://api.github.com/users/shinku721/following{/other_user}","gists_url":"https://api.github.com/users/shinku721/gists{/gist_id}","starred_url":"https://api.github.com/users/shinku721/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shinku721/subscriptions","organizations_url":"https://api.github.com/users/shinku721/orgs","repos_url":"https://api.github.com/users/shinku721/repos","events_url":"https://api.github.com/users/shinku721/events{/privacy}","received_events_url":"https://api.github.com/users/shinku721/received_events","type":"User","site_admin":false},"created_at":"2016-04-25T14:05:01Z","updated_at":"2016-04-25T14:05:01Z","body":"@FTwO-O 嗯，前面的理解一致\r\n\r\n> 另外，如果把时间戳和IV关联起来，比如每个IV由当时的时间戳通过某种算法生成，通过逆算法用密码和IV可以反解出时间戳，服务端不就也可以对IV进行合法性检验？\r\n\r\n我认为IV还是应当完全随机生成以避免任何可能的特征……也许可以用TOTP的方式生成IV部分数据？我不知道有没有这方面的cryptanalysis。"}}