<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div apple-content-edited="true"><br></div>
<br><div><div>On 11 Feb 2014, at 03:51, Adam Young <<a href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF" text="#000000" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="moz-cite-prefix">On 02/10/2014 09:19 AM, Abu Shohel Ahmed wrote:<br></div><blockquote cite="mid:6F6793DD-BC97-443E-A0FD-F523CEF4B84D@ericsson.com" type="cite"><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_105" style="font-size: 13px;">Hi,</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_27"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8568" style="font-size: small;">Currently, Keystone Token provider (both PKI and UUID) relies on uuid.uuid4 to generate token which</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8567" style="font-size: small;">is used as an authentication token during its lifetime.<span class="Apple-converted-space"> </span><br></span></div></blockquote><br>Not true for PKI tokens, only UUID. PKI tokens are crypto signd (CMS), and then their ID is the MD5 hash of the signed document.<br><br>And a new format it in the works…</div></blockquote><div><br></div><div>+ true</div><div><br></div><div>_get_token_id function overriding happens in pki.py</div><br><blockquote type="cite"><div bgcolor="#FFFFFF" text="#000000" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote cite="mid:6F6793DD-BC97-443E-A0FD-F523CEF4B84D@ericsson.com" type="cite"><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_59"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo;"><span id="yui_3_13_0_ym1_1_1392041012083_7734" style="color: rgb(206, 121, 36);">def</span> <span id="yui_3_13_0_ym1_1_1392041012083_8662" style="color: rgb(52, 187, 199);">_get_token_id</span>(self, token_data):</div><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo;"><span id="yui_3_13_0_ym1_9_1392041012083_40"><font id="yui_3_13_0_ym1_9_1392041012083_52" color="#0220b3"> </font></span><span style="color: rgb(206, 121, 36);">return</span> uuid.uuid4().<span id="yui_3_13_0_ym1_9_1392041012083_34" style="color: rgb(52, 187, 199);">hex</span></div></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_1_1392041012083_8663" style="font-size: 13px;">My question is how secure is UUID4 token. According to RFC 4122</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_64"></span></div><pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 16px; page-break-before: always;"><span id="yui_3_13_0_ym1_1_1392041012083_8518" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;">"Do not assume that UUIDs are hard to guess; they should not be used
as security capabilities (identifiers whose mere possession grants
access)"</span></pre><pre class="newpage" id="yui_3_13_0_ym1_9_1392041012083_68" style="font-family: 'Courier New'; margin-top: 0px; margin-bottom: 0px; white-space: pre-wrap; font-size: 1em; page-break-before: always;"></pre><div style="padding: 0px; margin: 0px; font-size: 11px; font-family: Menlo; color: rgb(2, 32, 179);"><span id="yui_3_13_0_ym1_9_1392041012083_71" style="color: rgb(52, 187, 199);"><br id="yui_3_13_0_ym1_9_1392041012083_77"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_74" style="font-size: 13px;">The implementation of UUID4 relies on os.urandom() which provides pretty good randomness. However, there are still </span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_83" style="font-size: 13px;">concerns about its randomness. See the thread here<a moz-do-not-send="true" href="http://stackoverflow.com/questions/817882/unique-session-id-in-python">http://stackoverflow.com/questions/817882/unique-session-id-in-python</a>. </span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_100" style="font-size: small;"><br id="yui_3_13_0_ym1_9_1392041012083_102"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><span id="yui_3_13_0_ym1_9_1392041012083_95" style="font-size: 13px;">Should it be a security bug for keystone ? If it is, both PKI and UUID token generation process is vulnerable.</span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_107"><br id="yui_3_13_0_ym1_9_1392041012083_113"></span></div><div style="padding: 0px; margin: 0px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 13px;"><span id="yui_3_13_0_ym1_9_1392041012083_110">...shohel</span></div><br><fieldset class="mimeAttachmentHeader"></fieldset><br><pre wrap="">_______________________________________________
Openstack-security mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a>
</pre></blockquote><br>_______________________________________________<br>Openstack-security mailing list<br><a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br></div></blockquote></div><br></body></html>