Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124612
Message-ID: <3a3de59c-c7c8-4124-b973-def153428290@bastelstu.be>
Date: Fri, 26 Jul 2024 15:02:42 +0200
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: Rob Landers <rob@bottled.codes>, Peter Stalman <sarkedev@gmail.com>
Cc: Derick Rethans <derick@php.net>, PHP internals <internals@lists.php.net>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
 <CAPrKfG4TijmZ_N9512_Fk9MBUNg=E6PjNTy-bCbV8CAj9_wX8A@mail.gmail.com>
 <6c0baa01-68e5-4d74-bc4e-d6830ab5076d@bastelstu.be>
 <cf0f0b2b-5df8-4b7b-bb03-a705f37d5e4a@app.fastmail.com>
Content-Language: en-US
In-Reply-To: <cf0f0b2b-5df8-4b7b-bb03-a705f37d5e4a@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

HI

On 7/26/24 14:50, Rob Landers wrote:
>>> $_SESSION['token'] = md5(uniqid(mt_rand(), true));
>>
>> *Exactly* the md5-uniqid construction that is called out as unsafe in
>> the RFC and used in a security context.
> 
> In regards to hashing, this is likely fine; for now. There still isn't an arbitrary pre-image attack on md5 (that I'm aware of). Can you create a random file with a matching hash? Yes, in a few seconds, on modern hardware. But you cannot yet make it have arbitrary contents in our lifetime. The NSA probably has something like this though, but if so, this isn't widely known.

Neither collision-, nor pre-image resistance is relevant here. The 
attack vector is a brute force attack / an attacker guessing the token 
rather than the token's contents.

> That being said, this is just randomly creating a random id without leaking it's internal construction, no different than putting an md5 in a UUID-v8. The real issue here is the use of uniqid() and rand(), making it quite likely (at scale, at least) that a session id will overlap with another session id.

The point is that it showcases a fundamental misunderstanding of what 
MD5 (or really any other hash algorithm) does for you. The application 
of the MD5 does not make the token more random or more unique or 
whatever positive adjective you would like to use. It would be equally 
strong (or rather weak) if the output of `uniqid(mt_rand(), true)` was 
used directly.

As per Kerckhoffs's principle, the security of the algorithm must not 
rely on the attacker not knowing how it's implemented. Given how 
prevalent constructions like the above are, an attacker could make an 
educated guess about how it looks like and match their own token against 
a precomputed table to find out if it matches.

Best regards
Tim Düsterhus