<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_105" style="font-size: 13px;">Hi,</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_27"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8568" style="font-size: small;">Currently, Keystone Token provider (both PKI and UUID) relies on uuid.uuid4 to generate token which</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8567" style="font-size: small;">is used as an authentication token during its lifetime. </span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_59"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo;"><span id="yui_3_13_0_ym1_1_1392041012083_7734" style="color: rgb(206, 121, 36);">def</span> <span id="yui_3_13_0_ym1_1_1392041012083_8662" style="color: rgb(52, 187, 199);">_get_token_id</span>(self, token_data):</div><p id="yui_3_13_0_ym1_1_1392041012083_7643" style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo;"></p><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo;"><span id="yui_3_13_0_ym1_9_1392041012083_40"><font color="#0220b3" id="yui_3_13_0_ym1_9_1392041012083_52"> </font></span><span style="color: rgb(206, 121, 36);">return</span> uuid.uuid4().<span id="yui_3_13_0_ym1_9_1392041012083_34" style="color: rgb(52, 187, 199);">hex</span></div></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8663" style="font-size: 13px;">My question is how secure is UUID4 token. According to RFC 4122</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_64"></span></div><pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 16px; page-break-before: always;"><span id="yui_3_13_0_ym1_1_1392041012083_8518" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;">"Do not assume that UUIDs are hard to guess; they should not be used
as security capabilities (identifiers whose mere possession grants
access)"</span></pre><pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 1em; page-break-before: always;"><br></pre><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo; color: rgb(2, 32, 179);"><span id="yui_3_13_0_ym1_9_1392041012083_71" style="color: rgb(52, 187, 199);"><br id="yui_3_13_0_ym1_9_1392041012083_77"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_74" style="font-size: 13px;">The implementation of UUID4 relies on os.urandom() which provides pretty good randomness. However, there are still </span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_83" style="font-size: 13px;">concerns about its randomness. See the thread here <a href="http://stackoverflow.com/questions/817882/unique-session-id-in-python">http://stackoverflow.com/questions/817882/unique-session-id-in-python</a>. </span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_100" style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_102"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_95" style="font-size: 13px;">Should it be a security bug for keystone ? If it is, both PKI and UUID token generation process is vulnerable.</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_107"><br id="yui_3_13_0_ym1_9_1392041012083_113"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_110">...shohel</span></div></body></html>