Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72654
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZxqmUVR3MhdMUBUuKxxkXndoTdoffbfuQ0oGc5JMvQ8dg@mail.gmail.com>
References: <CAPhkiZxqmUVR3MhdMUBUuKxxkXndoTdoffbfuQ0oGc5JMvQ8dg@mail.gmail.com>
Date: Mon, 17 Feb 2014 18:40:37 +0900
Message-ID: <CAGa2bXbBnPQHqBUxe=S3HZtvQHQLdomEM4CEF3F+O0mf4oaktA@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1132ee92133f3304f296f526
Subject: Re: [PHP-DEV] [VOTE] Secure Session Module Options/Internal by Default
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1132ee92133f3304f296f526
Content-Type: text/plain; charset=UTF-8

Hi Andrey,

On Mon, Feb 17, 2014 at 5:11 PM, Andrey Andreev <narf@devilix.net> wrote:

> I didn't want to interrupt a vote, but this 'id_length' setting was
> not initially a part of the RFC and it's just now that I see it.
>

I noticed possible attack during timing attack discussion. Therefore,
I've added this. User defined, 3rd party session or certain system's
save handler could be vulnerable.

Simplest one would be file system with liner directory search. It would
be possible to get 1st session ID on the system with timing attack.
I suppose this scenario is possible with embedded systems. If it is
affected, it would be very easy to attack by timing. We cannot assure
system, 3rd party or user save handler is timing safe because we
cannot control implementation. Setting minimum length removes
possibility of the attack.

I might post mail in different thread, sorry.

 I don't see how it relates to timing attacks.
> If it is about comparing at least N characters of the session ID
> before rejecting one, then why not just compare all of them? ID length
> is public information, anybody can see what it is by simply looking at
> what the application gives them.
> And finally, the setting name itself is misleading - it doesn't make
> it clear that it's about minimum length.
>

I agree. Java has similar name setting with different semantics.
Name could be anything. Better name would be appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1132ee92133f3304f296f526--