3

Say we have a session key of between 0000000000-9999999999, providing 33.2bits of entropy. This is far short of the 128bits recommended by most.

Of course, it is normally trivial to change session keys to be of reasonable length, but there are a lot of legacy systems out there using shorter session keys.

At what point, assuming that the generation of session keys is random, does the entropy mean that real-world attacks are possible?

33.2bits of entropy on a low-traffic site unable to handle high-speed brute-forcing is still a long time.

Cybergibbons
  • 1,251
  • 2
  • 9
  • 21
  • 1
    That can also make your site more likely to be brute forced (and possibly brought offline if it can't handle the traffic) as a short session key is more tempting than say the standard recommended 128bit key. Related OWASP article : https://www.owasp.org/index.php/Insufficient_Session-ID_Length –  Mar 10 '15 at 16:46
  • Searched OWASP and didn't see that specific page. Pretty much answers the question. – Cybergibbons Mar 10 '15 at 16:50

1 Answers1

3

Well, you said it. It depends on the context. Precisely, it depends on what the attacker has to do to test an hypothesis on the session key.

If the attacker, to test a key, must talk to your server, then this is an online attack and it won't go faster than what your server can do -- moreover, you could apply countermeasures, e.g. stop talking to clients that obviously engage in attackish behaviour. 33 bits ought to be enough for that. This is, after all, the situation of servers that do password-based authentication of clients.

If the attacker can just do computations on his own machines, to ascertain whether a potential session key is the right one or not, then this is an offline attack, limited only by the computing power available to the attacker. In that situation, 33 bits are way too few to be much of a problem for the attacker. Exact threshold depends on the attacker's motivation, his available computing power, his patience, and the amount of computations needed to verify one session key; but 33 bits are really too low for that.

Whether the context is that of an online or offline attack depends on the details of your protocols. If the "session key" is just sent to the server within a SSL tunnel (e.g. a cookie for an HTTPS Web site), then this is an "online attack" context. Just configure your firewall to block clients that connect too many times within a small time frame, and you should be fine (or, at least, finer than your competitors, so attackers will attack them, not you).

Thomas Pornin
  • 326,555
  • 60
  • 792
  • 962