Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124614
Feedback-ID: ifab94697:Fastmail
User-Agent: Cyrus-JMAP/3.11.0-alpha0-582-g5a02f8850-fm-20240719.002-g5a02f885
Precedence: bulk
MIME-Version: 1.0
Message-ID: <ecf83f7b-7bae-4f02-888e-401fc5ffea41@app.fastmail.com>
In-Reply-To: <3a3de59c-c7c8-4124-b973-def153428290@bastelstu.be>
References: 
 <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
 <CAPrKfG4TijmZ_N9512_Fk9MBUNg=E6PjNTy-bCbV8CAj9_wX8A@mail.gmail.com>
 <6c0baa01-68e5-4d74-bc4e-d6830ab5076d@bastelstu.be>
 <cf0f0b2b-5df8-4b7b-bb03-a705f37d5e4a@app.fastmail.com>
 <3a3de59c-c7c8-4124-b973-def153428290@bastelstu.be>
Date: Fri, 26 Jul 2024 15:25:28 +0200
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>,
 "Peter Stalman" <sarkedev@gmail.com>
Cc: "Derick Rethans" <derick@php.net>,
 "PHP internals" <internals@lists.php.net>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Content-Type: multipart/alternative;
 boundary=40e76ce876a748dca6b39dd94d6ca2b2
From: rob@bottled.codes ("Rob Landers")

--40e76ce876a748dca6b39dd94d6ca2b2
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 26, 2024, at 15:02, Tim D=C3=BCsterhus wrote:
> HI
>=20
> On 7/26/24 14:50, Rob Landers wrote:
> >>> $_SESSION['token'] =3D md5(uniqid(mt_rand(), true));
> >>
> >> *Exactly* the md5-uniqid construction that is called out as unsafe =
in
> >> the RFC and used in a security context.
> >=20
> > In regards to hashing, this is likely fine; for now. There still isn=
't an arbitrary pre-image attack on md5 (that I'm aware of). Can you cre=
ate a random file with a matching hash? Yes, in a few seconds, on modern=
 hardware. But you cannot yet make it have arbitrary contents in our lif=
etime. The NSA probably has something like this though, but if so, this =
isn't widely known.
>=20
> Neither collision-, nor pre-image resistance is relevant here. The=20
> attack vector is a brute force attack / an attacker guessing the token=20
> rather than the token's contents.

You do realize that GUID and md5 hashes are the same size? One does not =
simply "guess" a GUID or an md5 hash. gravatar used md5 until a couple o=
f years ago, and had millions? billions? of emails addresses and zero co=
llisions.

> > That being said, this is just randomly creating a random id without =
leaking it's internal construction, no different than putting an md5 in =
a UUID-v8. The real issue here is the use of uniqid() and rand(), making=
 it quite likely (at scale, at least) that a session id will overlap wit=
h another session id.
>=20
> The point is that it showcases a fundamental misunderstanding of what=20
> MD5 (or really any other hash algorithm) does for you. The application=20
> of the MD5 does not make the token more random or more unique or=20
> whatever positive adjective you would like to use. It would be equally=20
> strong (or rather weak) if the output of `uniqid(mt_rand(), true)` was=20
> used directly.

Yes, it does, but probably not how you think. It would be much weaker to=
 leak the internal construction (uniqid(mt_rand(), true)) because then s=
omeone could literally guess a working id if they knew when the id was g=
enerated (depending on the size of mt_rand, rate limits, etc).

By wrapping it in an md5, it is literally unguessable how it is construc=
ted, but the construction is still crap in this case.

>=20
> As per Kerckhoffs's principle, the security of the algorithm must not=20
> rely on the attacker not knowing how it's implemented. Given how=20
> prevalent constructions like the above are, an attacker could make an=20
> educated guess about how it looks like and match their own token again=
st=20
> a precomputed table to find out if it matches.

In this example, an ID is being constructed. If it needs uniqueness, the=
 ID is being constructed incorrectly, but if you could argue that a GUID=
 would fit the bill here, md5 has more "entropy" than a GUIDv4. But due =
to how the md5 is constructed, it actually has less entropy. So, I think=
 we both can agree that the construction is crap. However, the usage of =
md5 doesn't matter here. If it really bothers you, craft a GUIDv8 from i=
t.

But to Kerckhoffs's principle, that is in regards to encryption ... this=
 is not encryption.

=E2=80=94 Rob
--40e76ce876a748dca6b39dd94d6ca2b2
Content-Type: text/html;charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Fri, Jul 26,=
 2024, at 15:02, Tim D=C3=BCsterhus wrote:<br></div><blockquote type=3D"=
cite" id=3D"qt" style=3D""><div>HI<br></div><div><br></div><div>On 7/26/=
24 14:50, Rob Landers wrote:<br></div><div>&gt;&gt;&gt; $_SESSION['token=
'] =3D md5(uniqid(mt_rand(), true));<br></div><div>&gt;&gt;<br></div><di=
v>&gt;&gt; *Exactly* the md5-uniqid construction that is called out as u=
nsafe in<br></div><div>&gt;&gt; the RFC and used in a security context.<=
br></div><div>&gt;&nbsp;<br></div><div>&gt; In regards to hashing, this =
is likely fine; for now. There still isn't an arbitrary pre-image attack=
 on md5 (that I'm aware of). Can you create a random file with a matchin=
g hash? Yes, in a few seconds, on modern hardware. But you cannot yet ma=
ke it have arbitrary contents in our lifetime. The NSA probably has some=
thing like this though, but if so, this isn't widely known.<br></div><di=
v><br></div><div>Neither collision-, nor pre-image resistance is relevan=
t here. The&nbsp;<br></div><div>attack vector is a brute force attack / =
an attacker guessing the token&nbsp;<br></div><div>rather than the token=
's contents.<br></div></blockquote><div><br></div><div>You do realize th=
at GUID and md5 hashes are the same size? One does not simply "guess" a =
GUID or an md5 hash. gravatar used md5 until a couple of years ago, and =
had millions? billions? of emails addresses and zero collisions.<br></di=
v><div><br></div><blockquote type=3D"cite" id=3D"qt" style=3D""><div>&gt=
; That being said, this is just randomly creating a random id without le=
aking it's internal construction, no different than putting an md5 in a =
UUID-v8. The real issue here is the use of uniqid() and rand(), making i=
t quite likely (at scale, at least) that a session id will overlap with =
another session id.<br></div><div><br></div><div>The point is that it sh=
owcases a fundamental misunderstanding of what&nbsp;<br></div><div>MD5 (=
or really any other hash algorithm) does for you. The application&nbsp;<=
br></div><div>of the MD5 does not make the token more random or more uni=
que or&nbsp;<br></div><div>whatever positive adjective you would like to=
 use. It would be equally&nbsp;<br></div><div>strong (or rather weak) if=
 the output of `uniqid(mt_rand(), true)` was&nbsp;<br></div><div>used di=
rectly.<br></div></blockquote><div><br></div><div>Yes, it does, but prob=
ably not how you think. It would be much weaker to leak the internal con=
struction (uniqid(mt_rand(), true)) because then someone could literally=
 guess a working id if they knew when the id was generated (depending on=
 the size of mt_rand, rate limits, etc).<br></div><div><br></div><div>By=
 wrapping it in an md5, it is literally unguessable how it is constructe=
d, but the construction is still crap in this case.<br></div><div><br></=
div><blockquote type=3D"cite" id=3D"qt" style=3D""><div><br></div><div>A=
s per Kerckhoffs's principle, the security of the algorithm must not&nbs=
p;<br></div><div>rely on the attacker not knowing how it's implemented. =
Given how&nbsp;<br></div><div>prevalent constructions like the above are=
, an attacker could make an&nbsp;<br></div><div>educated guess about how=
 it looks like and match their own token against&nbsp;<br></div><div>a p=
recomputed table to find out if it matches.<br></div></blockquote><div><=
br></div><div>In this example, an ID is being constructed. If it needs u=
niqueness, the ID is being constructed incorrectly, but if you could arg=
ue that a GUID would fit the bill here, md5 has more "entropy" than a GU=
IDv4. But due to how the md5 is constructed, it actually has less entrop=
y. So, I think we both can agree that the construction is crap. However,=
 the usage of md5 doesn't matter here. If it really bothers you, craft a=
 GUIDv8 from it.<br></div><div><br></div><div>But to&nbsp;Kerckhoffs's p=
rinciple, that is in regards to encryption ... this is not encryption.<b=
r></div><div><br></div><div id=3D"sig121229152">=E2=80=94 Rob<br></div><=
/body></html>
--40e76ce876a748dca6b39dd94d6ca2b2--