6 ms·
You seem to be knowledgable on these topics, so I have a question... If I take the query string parameters and then a ridiculously long pre-determined salt (30
by kirse 18y ago
You seem to be knowledgable on these topics, so I have a question... If I take the query string parameters and then a ridiculously long pre-determined salt (30 chars) to create a SHA-256 signature for POSTing, what's the chance that this will actually result in collisions / cracking?
Even if null data is submitted and someone sniffs the salt, it's still 30-chars long and last I checked rainbow tables don't work too well on SHA-256 hashes of that length.
I ask because I use a system similar to this to just do a basic check to ensure that a form POST is coming from a user clicking an action and not just some random spammers' form just posting the needed vars. It's nothing particularly secure (I think), just a nuisance to any spammer.
- tptacek 18y agoFirst, you're talking about a nonce, not a salt. You'd be a happier person if you took the word "salt" out of your CS vocabulary. Second, the vulnerability here isn't password cracking; it's that AMZN verifies the signature on canonicalized data, but operates on non-canonicalized data.
- kirse 18y agoThanks! I understand the Amazon vulnerability fully, I was just referring to my own web-app development. It's not an issue though because I don't do the key/value pair splitting as they do.
- tptacek 18y agoWhy are you "signing" your data at all? You're doing it wrong. Use SSL to secure the whole transport; use form or HTTP auth to make sure you know who you're talking to.
- deleted 18y ago[deleted]
- cperciva 18y agoSigning requests with an HMAC provides end-to-end authentication, which is vastly superior to transport-level authentication such as HTTP auth.
- tptacek 18y agoYou skipped the HTTPS part of my recommendation, which is vastly superior to homebrewed HMAC.
- cperciva 18y agoHTTPS is irrelevant to what I said. End-to-end authentication is better than transport-level authentication. Using an HMAC to sign requests and then sending those signed requests over HTTPS is better than using HTTP auth over HTTPS.
- tptacek 18y agoYes, but what you said is irrelevant to what I said, and so we are at an impasse. =)