Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
RE: (chaffing and winnowing) Whitepaper "SESSION RIDING - A Widespread Vulnerability in To day's Web Applications"
From: Evans, Arian (Arian.Evansfishnetsecurity.com)
Date: Mon Jan 10 2005 - 16:46:11 CST
> -----Original Message-----
> From: Florian Weimer [mailto:fwdeneb.enyo.de]
> * Jim Weiler:
> > Couldn't the secret be any unpredictable value that the server can
> > come up with, like a GUID or the timestamp of the user login, and
> > not something that uses encryption?
1. Using timestamp for a token would be a bad idea. Anything cyclical,
predictable would be a bad idea. (or are you talking HMAC dynamic seed?)
> Yes, and a HMAC provides that. You have to make the value depending
> on the web application user (and preferably the time), otherwise users
> could attack each other. Of course, you can also use a decent PRNG to
> generate a token, and store it in the user's session object on the
> server side. But this might be more complicated to implement.
2. Nonetheless, a PRNG in the user's session object is the right idea.
> A HMAC is not really encryption---but thanks to chaffing and
> winnowing, all authentication schemes also permit encryption, albeit
> with a significant overhead.
3. Winnowing != encryption. While some crypto for the non-cryptographer
books and equivocating college professors 'crypto classes' for CS majors
may imply or state this is the case, it's simply not.
The guy who wrote the original paper on this explicitly contrasted
it to encryption. </pedantic> It is, however, an interesting and
little-used confidentiality mechanism.
If your definition of encryption = "any form of obfuscation", then
winnowing = encryption. But then again, by that definition, most
of my responses to this list are "encrypted".
Sr. Security Engineer
KC Office: 816.421.6611
Toll Free: 888.732.9406
The information transmitted in this e-mail is intended only for the addressee and may contain confidential and/or privileged material.
Any interception, review, retransmission, dissemination, or other use of, or taking of any action upon this information by persons or entities
other than the intended recipient is prohibited by law and may subject them to criminal or civil liability. If you received this communication
in error, please contact us immediately at 816.421.6611, and delete the communication from any computer or network system.