Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92236
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.194 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZxtf=WHxu9H9MUSXnY2WEsSvLa0wBeqNTTeR+zNGRp93g@mail.gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <5706EEF3.3050705@gmail.com> <CAGa2bXbQkw2ouDJf5FHk3dbA4Xea4DmCwPdHUt_WRQ7H=EMAeQ@mail.gmail.com>
 <570CB007.2080503@php.net> <CAGKNXQGJ9a5AmsN-GV4N1yKh2Q4SH+4-Dfi9vfgX2top11F8Fg@mail.gmail.com>
 <CAGa2bXYEahrG-roa-NB634i5yw4+7uFgyLRmtf57TMdZ_cjE1w@mail.gmail.com> <CAPhkiZxtf=WHxu9H9MUSXnY2WEsSvLa0wBeqNTTeR+zNGRp93g@mail.gmail.com>
Date: Wed, 13 Apr 2016 06:59:02 +0900
Message-ID: <CAGa2bXbhV6H95hO_QgB2=f4Ja1cntdO6vKVX2zqL9mstNJ_JjQ@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: Philip Hofstetter <phofstetter@sensational.ch>, Michael Wallner <mike@php.net>, 
	Stanislav Malyshev <smalyshev@gmail.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Andrey,

On Tue, Apr 12, 2016 at 8:12 PM, Andrey Andreev <narf@devilix.net> wrote:
>
> On Tue, Apr 12, 2016 at 2:04 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>>
>> Hi Philip,
>>
>> On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter
>> <phofstetter@sensational.ch> wrote:
>> > On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner <mike@php.net> wrote:
>> >> On 08/04/16 04:17, Yasuo Ohgaki wrote:
>> >>
>> >>> PRNG like /dev/urandom is supposed to be secure, but fair point. It
>> >>> may be good idea keeping old hash based session ID just in case
>> >>> someone find vulnerability. I suppose it's unlikely with modern PRNGs,
>> >>> though.
>> >>
>> >> I've come to think that "unlikely" is still a bad precondition with
>> >> regards to security... :)
>> >
>> > however, if a vulnerability is found in /dev/urandom, that would be a
>> > stop-what-you're-doing-and-patch moment anyways because so much stuff
>> > depends on /dev/(u)random not producing predictable output.
>> >
>> > If /dev/urandom is not to be trusted, you have to bring your server
>> > offline right then. The fact that PHP would continue to produce more
>> > secure session IDs won't help you much.
>>
>> If there is such severe vulnerability, not only session but also many
>> crypt
>> related features cannot be trusted.
>>
>> Anyway, I'll add mitigation that reads random length of bytes from PRNG.
>> This should be good enough to hide PRNG state. Expert comments on
>> this is appreciated.
>>
>
> How are you going to read a *random* length of bytes from the randomness
> source itself? That's a chicken and egg problem. :)

If you say so, current implementation is also vulnerable :)

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net