Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92219
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.214.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYEahrG-roa-NB634i5yw4+7uFgyLRmtf57TMdZ_cjE1w@mail.gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
	<5706EEF3.3050705@gmail.com>
	<CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
	<570CB007.2080503@php.net>
	<CAGKNXQGJ9a5AmsN-GV4N1yKh2Q4SH+4-Dfi9vfgX2top11F8Fg@mail.gmail.com>
	<CAGa2bXYEahrG-roa-NB634i5yw4+7uFgyLRmtf57TMdZ_cjE1w@mail.gmail.com>
Date: Tue, 12 Apr 2016 14:12:40 +0300
Message-ID: <CAPhkiZxtf=WHxu9H9MUSXnY2WEsSvLa0wBeqNTTeR+zNGRp93g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Philip Hofstetter <phofstetter@sensational.ch>, Michael Wallner <mike@php.net>, 
	Stanislav Malyshev <smalyshev@gmail.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e011760e352e2a0053047bdba
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
From: narf@devilix.net (Andrey Andreev)

--089e011760e352e2a0053047bdba
Content-Type: text/plain; charset=UTF-8

Hi,

On Tue, Apr 12, 2016 at 2:04 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Philip,
>
> On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter
> <phofstetter@sensational.ch> wrote:
> > On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner <mike@php.net> wrote:
> >> On 08/04/16 04:17, Yasuo Ohgaki wrote:
> >>
> >>> PRNG like /dev/urandom is supposed to be secure, but fair point. It
> >>> may be good idea keeping old hash based session ID just in case
> >>> someone find vulnerability. I suppose it's unlikely with modern PRNGs,
> >>> though.
> >>
> >> I've come to think that "unlikely" is still a bad precondition with
> >> regards to security... :)
> >
> > however, if a vulnerability is found in /dev/urandom, that would be a
> > stop-what-you're-doing-and-patch moment anyways because so much stuff
> > depends on /dev/(u)random not producing predictable output.
> >
> > If /dev/urandom is not to be trusted, you have to bring your server
> > offline right then. The fact that PHP would continue to produce more
> > secure session IDs won't help you much.
>
> If there is such severe vulnerability, not only session but also many crypt
> related features cannot be trusted.
>
> Anyway, I'll add mitigation that reads random length of bytes from PRNG.
> This should be good enough to hide PRNG state. Expert comments on
> this is appreciated.
>
>
How are you going to read a *random* length of bytes from the randomness
source itself? That's a chicken and egg problem. :)

Cheers,
Andrey.

--089e011760e352e2a0053047bdba--