<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 02/10/2014 09:19 AM, Abu Shohel
Ahmed wrote:<br>
</div>
<blockquote
cite="mid:6F6793DD-BC97-443E-A0FD-F523CEF4B84D@ericsson.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_105"
style="font-size: 13px;">Hi,</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span style="font-size: small;"><br
id="yui_3_13_0_ym1_9_1392041012083_27">
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8568"
style="font-size: small;">Currently, Keystone Token provider
(both PKI and UUID) relies on uuid.uuid4 to generate token
which</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8567"
style="font-size: small;">is used as an authentication token
during its lifetime. <br>
</span></div>
</blockquote>
<br>
Not true for PKI tokens, only UUID. PKI tokens are crypto signd
(CMS), and then their ID is the MD5 hash of the signed document.<br>
<br>
And a new format it in the works...<br>
<blockquote
cite="mid:6F6793DD-BC97-443E-A0FD-F523CEF4B84D@ericsson.com"
type="cite">
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span style="font-size: small;"><br
id="yui_3_13_0_ym1_9_1392041012083_59">
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;">
<div style="padding: 0px; margin: 0px; font-size: 11px;
font-family: Menlo;"><span
id="yui_3_13_0_ym1_1_1392041012083_7734" style="color:
rgb(206, 121, 36);">def</span> <span
id="yui_3_13_0_ym1_1_1392041012083_8662" style="color:
rgb(52, 187, 199);">_get_token_id</span>(self, token_data):</div>
<div style="padding: 0px; margin: 0px; font-size: 11px;
font-family: Menlo;"><span
id="yui_3_13_0_ym1_9_1392041012083_40"><font
id="yui_3_13_0_ym1_9_1392041012083_52" color="#0220b3">
</font></span><span style="color: rgb(206, 121, 36);">return</span> uuid.uuid4().<span
id="yui_3_13_0_ym1_9_1392041012083_34" style="color: rgb(52,
187, 199);">hex</span></div>
</div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span style="font-size: small;"><br>
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8663"
style="font-size: 13px;">My question is how secure is UUID4
token. According to RFC 4122</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span style="font-size: small;"><br
id="yui_3_13_0_ym1_9_1392041012083_64">
</span></div>
<pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 16px; page-break-before: always;"><span id="yui_3_13_0_ym1_1_1392041012083_8518" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;">"Do not assume that UUIDs are hard to guess; they should not be used
as security capabilities (identifiers whose mere possession grants
access)"</span></pre>
<pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 1em; page-break-before: always;">
</pre>
<div style="padding: 0px; margin: 0px; font-size: 11px;
font-family: Menlo; color: rgb(2, 32, 179);"><span
id="yui_3_13_0_ym1_9_1392041012083_71" style="color: rgb(52,
187, 199);"><br id="yui_3_13_0_ym1_9_1392041012083_77">
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_74"
style="font-size: 13px;">The implementation of UUID4 relies on
os.urandom() which provides pretty good randomness. However,
there are still </span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_83"
style="font-size: 13px;">concerns about its randomness. See
the thread here <a moz-do-not-send="true"
href="http://stackoverflow.com/questions/817882/unique-session-id-in-python">http://stackoverflow.com/questions/817882/unique-session-id-in-python</a>. </span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_100"
style="font-size: small;"><br
id="yui_3_13_0_ym1_9_1392041012083_102">
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_95"
style="font-size: 13px;">Should it be a security bug for
keystone ? If it is, both PKI and UUID token generation
process is vulnerable.</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_107"><br
id="yui_3_13_0_ym1_9_1392041012083_113">
</span></div>
<div style="padding: 0px; margin: 0px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;
font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_110">...shohel</span></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Openstack-security mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a>
</pre>
</blockquote>
<br>
</body>
</html>