Re: [xmpp] IQ Handling vulnerabilities

[Thijs Alkemade <[e-mail]>]

On 6 feb. 2014, at 23:30, Peter Saint-Andre <[e-mail]> wrote:

>>> b) Use predictably generated ids for stanzas (ill-advised, but not
>>> strictly wrong)
>> 
>> We need to fix the advice given in
>> http://xmpp.org/rfcs/rfc6120.html#stanzas-attributes-id
> 
> Yes, that too - probably we'd want to say that 'id' values ought to be random (e.g., UUIDs).

Well, actually...

The property we really want from ids is that predicting the next one(s) given
some historic ones is hard. That is not a guarantee UUIDs give by definition.
The time based UUIDs (version 1) obviously don't have this property, but also
randomly generated UUIDs (version 4) may be generated with any PRNG, even
linear congruential ones. In fact, the Security Considerations of RFC 4122
cover this:

   Do not assume that UUIDs are hard to guess; they should not be used
   as security capabilities (identifiers whose mere possession grants
   access), for example.  A predictable random number source will
   exacerbate the situation.

I'm afraid that suggesting to use UUIDs will cause people to still not check
the 'from' attribute, but to assume their UUIDs are impossible to predict by
others. I think it would be better advise to grab 8 or 16 bytes from a CSPRNG
and hex-encode/base64-encode/SHA1-hash that.

> Who's volunteering to write this up? Maybe Thijs?

Yes, I would be willing to do this.

Thijs