Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92218
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.66 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGKNXQGJ9a5AmsN-GV4N1yKh2Q4SH+4-Dfi9vfgX2top11F8Fg@mail.gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <5706EEF3.3050705@gmail.com> <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
 <570CB007.2080503@php.net> <CAGKNXQGJ9a5AmsN-GV4N1yKh2Q4SH+4-Dfi9vfgX2top11F8Fg@mail.gmail.com>
Date: Tue, 12 Apr 2016 20:04:12 +0900
Message-ID: <CAGa2bXYEahrG-roa-NB634i5yw4+7uFgyLRmtf57TMdZ_cjE1w@mail.gmail.com>
To: Philip Hofstetter <phofstetter@sensational.ch>
Cc: Michael Wallner <mike@php.net>, Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Philip,

On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter
<phofstetter@sensational.ch> wrote:
> On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner <mike@php.net> wrote:
>> On 08/04/16 04:17, Yasuo Ohgaki wrote:
>>
>>> PRNG like /dev/urandom is supposed to be secure, but fair point. It
>>> may be good idea keeping old hash based session ID just in case
>>> someone find vulnerability. I suppose it's unlikely with modern PRNGs,
>>> though.
>>
>> I've come to think that "unlikely" is still a bad precondition with
>> regards to security... :)
>
> however, if a vulnerability is found in /dev/urandom, that would be a
> stop-what-you're-doing-and-patch moment anyways because so much stuff
> depends on /dev/(u)random not producing predictable output.
>
> If /dev/urandom is not to be trusted, you have to bring your server
> offline right then. The fact that PHP would continue to produce more
> secure session IDs won't help you much.

If there is such severe vulnerability, not only session but also many crypt
related features cannot be trusted.

Anyway, I'll add mitigation that reads random length of bytes from PRNG.
This should be good enough to hide PRNG state. Expert comments on
this is appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net