Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92214
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.51 as permitted sender)
Sender: Michael Wallner <mike.php.net@gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 Stanislav Malyshev <smalyshev@gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <5706EEF3.3050705@gmail.com>
 <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <570CB007.2080503@php.net>
Date: Tue, 12 Apr 2016 10:21:27 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.7.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="Kine6MD3DJPUiqqktlcNOxi8uO64IgguT"
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
From: mike@php.net (Michael Wallner)

--Kine6MD3DJPUiqqktlcNOxi8uO64IgguT
Content-Type: multipart/mixed; boundary="IdbBI7LVuom43M2JF013xXihL0LGic0wW"
From: Michael Wallner <mike@php.net>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <570CB007.2080503@php.net>
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <5706EEF3.3050705@gmail.com>
 <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
In-Reply-To: <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>

--IdbBI7LVuom43M2JF013xXihL0LGic0wW
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 08/04/16 04:17, Yasuo Ohgaki wrote:

> PRNG like /dev/urandom is supposed to be secure, but fair point. It
> may be good idea keeping old hash based session ID just in case
> someone find vulnerability. I suppose it's unlikely with modern PRNGs,
> though.

I've come to think that "unlikely" is still a bad precondition with
regards to security... :)

>=20
> If we have to care about PRNG state exposure, code may be changed to
> read random length from RPNG. This would be good enough mitigation. I
> would like to hear from PRNG experts if this is good enough. (or not
> needed)
>=20
>> Second, I do not see why we need to do maximum
>> breakage change if we could just make an identity "hash" function and
>> support both cases. "Session generation performance" does not have a l=
ot
>> of meaning here - I'd be very surprised to see any application that is=

>> bound by the speed of generating session IDs.
>=20
> w/ Patch: Requests per second: 2278.59 [#/sec] (mean)
> w/o Patch: Requests per second: 899.36 [#/sec] (mean)
> (This is CLI server and "ab -c 20 -n 100000" result on Core i7 4770s Li=
nux)
>=20
> I didn't expect this much difference, but this is the result. Since
> security experts advise to change session ID relatively high frequency
> (few minutes to half an hour), this difference may be noticeable apps
> returning cached JSON. I know apps that change session ID on every
> request. (This should be done with caution. Otherwise, you may
> experience lost sessions a lot due to race conditions) Such apps will
> see performance gain.

This RPS change is the result of just omitting hashing of the session id?=



--=20
Regards,
Mike


--IdbBI7LVuom43M2JF013xXihL0LGic0wW--

--Kine6MD3DJPUiqqktlcNOxi8uO64IgguT
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJXDLAHAAoJEEgOPhSwpMfHNWEH/A5KtxyYRxWo9iNStHUn086K
K7Gb/Q4p8dZkrjY+pvgkidA76HQCJEupRnOu0wkLQ/+EfQVLWlZjRA1znxCkIhgM
Sm2G1nCmg9PfR6sZGy05Sn/BUCDAVpoc6wgmVRpmLnnOi2T0UxGQJbvxF4/NlqIH
xDQs3nPRvHF6kKtHcDeaGgA+oFgAXfjSAGABEQfOeRpRvs4cdf6w+QABRK/6xy+H
AZkq04cDZhfS+Bsr932vEMjrvVvGxqsWibj3ZgFItXNoqRPf25UgqALODI75rRCi
oYkvN+q9PDT7eM1R1Vu36ynjyn3EUtZ+upnEEV6fMEeyKsrEiYtndKcJ2ZMW69I=
=Q3Vv
-----END PGP SIGNATURE-----

--Kine6MD3DJPUiqqktlcNOxi8uO64IgguT--