<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Of cause, ids/secrets are not sequential. May be I wrote it a
potentially confusing way.<br>
</p>
<p>When hacker makes guesses, he will be guessing first byte/letter,
then second byte/letter, producing results like `a...`, `aD...`,
etc. There is a sequence in which attacker approacher this search
problem. But secrets themselves should be random.<br>
</p>
<br>
<div class="moz-cite-prefix">On 2018-06-06 03:46 PM, Khalid
Baheyeldin wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CA+TuoW2CFa6urc_X_t-1a4+gt3E3b6UfnV1pLkopRQBD=3dQVg@mail.gmail.com">
<div dir="ltr">On Wed, Jun 6, 2018 at 2:52 PM, Mikalai Birukou via
kwlug-disc <span dir="ltr"><<a
href="mailto:kwlug-disc@kwlug.org" target="_blank"
moz-do-not-send="true">kwlug-disc@kwlug.org</a>></span>
wrote:<br>
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><br>
Sometimes we store secret session ids in db, and we use
these for authentication. Usually there is query that get
respective record, searching a table for a given by user
session id.<br>
Usual `WHERE` clause uses the most fast comparison, which
run timing is dependent on input values. This can be used
as a base for an attack with session id guessing via
timing.<br>
</blockquote>
<div><br>
</div>
<div>Are the session IDs sequential? If so, then they should
not (ideally) be so.<br>
<br>
</div>
<div>For example, in Drupal, when it wants to create a
session, it calls PHP's session_id() with a function that
basically gets some random bytes, does a base64 encode on
them, and uses that as the session key. <br>
<br>
The random bytes are from a variety of sources: if OpenSSL
is installed, then pseudo random bytes from it are
requests, otherwise, /dev/urandom, process ID,
microtime(), ....etc.<br>
<br>
So, nothing sequential gets used, or stored. <br>
<br>
</div>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>Khalid M. Baheyeldin<br>
<a href="http://2bits.com" target="_blank"
moz-do-not-send="true">2bits.com</a>, Inc.<br>
Fast Reliable Drupal<br>
Drupal optimization, development, customization and
consulting.<br>
Simplicity is prerequisite for reliability. -- Edsger
W.Dijkstra<br>
Simplicity is the ultimate sophistication. -- anonymous<br>
<br>
</div>
</div>
</div>
</div>
</div>
<!--'"--><br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
kwlug-disc mailing list
<a class="moz-txt-link-abbreviated" href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a>
<a class="moz-txt-link-freetext" href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a>
</pre>
</blockquote>
<br>
</body>
</html>