Re: IQ Handling vulnerabilities

On 6 feb. 2014, at 23:30, Peter Saint-Andre <[email protected]> wrote:

>>> b) Use predictably generated ids for stanzas (ill-advised, but not
>>> strictly wrong)
>> 
>> We need to fix the advice given in
>> http://xmpp.org/rfcs/rfc6120.html#stanzas-attributes-id
> 
> Yes, that too - probably we'd want to say that 'id' values ought to be random (e.g., UUIDs).

Well, actually...

The property we really want from ids is that predicting the next one(s) given
some historic ones is hard. That is not a guarantee UUIDs give by definition.
The time based UUIDs (version 1) obviously don't have this property, but also
randomly generated UUIDs (version 4) may be generated with any PRNG, even
linear congruential ones. In fact, the Security Considerations of RFC 4122
cover this:

   Do not assume that UUIDs are hard to guess; they should not be used
   as security capabilities (identifiers whose mere possession grants
   access), for example.  A predictable random number source will
   exacerbate the situation.

I'm afraid that suggesting to use UUIDs will cause people to still not check
the 'from' attribute, but to assume their UUIDs are impossible to predict by
others. I think it would be better advise to grab 8 or 16 bytes from a CSPRNG
and hex-encode/base64-encode/SHA1-hash that.

> Who's volunteering to write this up? Maybe Thijs?

Yes, I would be willing to do this.

Thijs

_______________________________________________
xmpp mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/xmpp

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJS9LmfAAoJELRGwhIrI4PEsUcP/3mK7BH+O79tBmPgGd6MaGLN
MIYP10OPWaQ3zG0HMiY4BcXEyo+Gg1bNVVe+rejRmwNJs+P730S6wCsYx6LfYFUS
EAHanceM9nvlhXNkA4PcLj/uSDs9nNwNuayPSezdPAWL4cTD74X51Qa+8s/lglGo
KFdoYMogDz4E63Vl5e2e8J0+4jUwkKjrdz44/X3DvcGc4yavZqeZPo6Y7BI23RGF
/Fr2nbakmj3bVj3LSd9lHIvtaJ9FlzUpqNKtbDEVA4WcoCkf04/joO/uPWKhkjAn
p/oytrY1P88QuJSkJfHbQrk54U6wCZJkkhB8W5nsJZFKNuBAKsycxZSDWdp2ZZ+1
kqVi3yefIBGonKjx0fEIOWB47pN4Mw6GBs45wth+pvzAAA4kywpB1LbeaTUSATYO
7C34DGPYf+4GNeURBx0bkQmpknxbvMumRuouJNGSJ5+9oT2WAyXUmuItZMFCnjU5
j2CVWXqmpj1GaBncGIMvOZP10U2dsyh8kUjPZCAh8v8d8TpEgEvPSRHTzU0afsNy
h8cpxwFXU8q6hycJJNzOL1KaCGxdHFRR4Y2lSNqEkmN/shght9IcQO8hBzN+lL6X
Gh2qEHIx1L0TIhiK2q8O8Hf0VyUijTfGvPclP91tKy3D65B+01VJ1lPRgS8GjjcI
hZpbWZ+vimGuf2/aQc9e
=ZCDv
-----END PGP SIGNATURE-----