RE: (chaffing and winnowing) Whitepaper "SESSION RIDING - A Widespread Vulnerability in To day's Web Applications"

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

Three thoughts:

> -----Original Message-----
> From: Florian Weimer [mailto:fw () deneb enyo de] 
> * Jim Weiler:
>
> > Couldn't the secret be any unpredictable value that the server can
> > come up with, like a GUID or the timestamp of the user login, and
> > not something that uses encryption?

1. Using timestamp for a token would be a bad idea. Anything cyclical,
predictable would be a bad idea. (or are you talking HMAC dynamic seed?)
 
> Yes, and a HMAC provides that.  You have to make the value depending
> on the web application user (and preferably the time), otherwise users
> could attack each other.  Of course, you can also use a decent PRNG to
> generate a token, and store it in the user's session object on the
> server side.  But this might be more complicated to implement.

2. Nonetheless, a PRNG in the user's session object is the right idea.
 
> A HMAC is not really encryption---but thanks to chaffing and
> winnowing, all authentication schemes also permit encryption, albeit
> with a significant overhead.

3. Winnowing != encryption. While some crypto for the non-cryptographer
books and equivocating college professors 'crypto classes' for CS majors
may imply or state this is the case, it's simply not.

The guy who wrote the original paper on this explicitly contrasted
it to encryption. </pedantic> It is, however, an interesting and
little-used confidentiality mechanism.

If your definition of encryption = "any form of obfuscation", then
winnowing = encryption. But then again, by that definition, most
of my responses to this list are "encrypted".

Arian Evans
Sr. Security Engineer
FishNet Security

KC Office:  816.421.6611
Direct: 816.701.2045
Toll Free:  888.732.9406
Fax:  816.474.0394

http://www.fishnetsecurity.com



The information transmitted in this e-mail is intended only for the addressee and may contain confidential and/or 
privileged material. 
Any interception, review, retransmission, dissemination, or other use of, or taking of any action upon this information 
by persons or entities
other than the intended recipient is prohibited by law and may subject them to criminal or civil liability. If you 
received this communication 
in error, please contact us immediately at 816.421.6611, and delete the communication from any computer or network 
system.