Opened 6 years ago

Closed 6 years ago

#12016 closed defect (fixed)

Report ID Generated with Insecure RNG

Reported by: hellais Owned by: hellais
Priority: Medium Milestone:
Component: Archived/Ooni Version:
Severity: Keywords: oonib
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

defuse reported:

In #48 we are discussing the report ID being leaked through side channels. There is currently a more severe issue: The random characters in the report ID are generated with an insecure (predictable) random number generator:

import random
# ...
def randomStr(length, num=True):

"""
Returns a random a mixed lowercase, uppercase, alfanumerical (if num True)
string long length
"""
chars = string.ascii_lowercase + string.ascii_uppercase
if num:

chars += string.digits

return .join(random.choice(chars) for x in range(length))]

If the report ID is to be used for authentication, those characters should be generated with a CSPRNG.

Note: This is not part of the Least Authority audit.

Child Tickets

Change History (2)

comment:1 Changed 6 years ago by hellais

comment:2 Changed 6 years ago by hellais

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.