{"action":"created","issue":{"url":"https://api.github.com/repos/putaolabs/hunt/issues/51","repository_url":"https://api.github.com/repos/putaolabs/hunt","labels_url":"https://api.github.com/repos/putaolabs/hunt/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/putaolabs/hunt/issues/51/comments","events_url":"https://api.github.com/repos/putaolabs/hunt/issues/51/events","html_url":"https://github.com/putaolabs/hunt/issues/51","id":188720018,"number":51,"title":"The session ID is not safe","user":{"login":"cym13","id":4958985,"avatar_url":"https://avatars.githubusercontent.com/u/4958985?v=3","gravatar_id":"","url":"https://api.github.com/users/cym13","html_url":"https://github.com/cym13","followers_url":"https://api.github.com/users/cym13/followers","following_url":"https://api.github.com/users/cym13/following{/other_user}","gists_url":"https://api.github.com/users/cym13/gists{/gist_id}","starred_url":"https://api.github.com/users/cym13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cym13/subscriptions","organizations_url":"https://api.github.com/users/cym13/orgs","repos_url":"https://api.github.com/users/cym13/repos","events_url":"https://api.github.com/users/cym13/events{/privacy}","received_events_url":"https://api.github.com/users/cym13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-11T09:34:45Z","updated_at":"2016-11-11T12:26:19Z","closed_at":null,"body":"The problem\r\n===========\r\n\r\nThe way the session ID as generated is unsafe :\r\n\r\n    public string generateSessionId()\r\n    {\r\n        import std.digest.sha;\r\n        import std.format;\r\n        import std.datetime;\r\n        import std.random;\r\n        import core.cpuid;\r\n        import std.string;\r\n\r\n        auto str = toHexString(sha1Of(format(\"%s--%s--%s\",\r\n            Clock.currTime().toISOExtString, uniform(long.min, long.max), processor())));\r\n\r\n        return toLower(cast(string)(str[]));\r\n    }\r\n\r\nThis showcases many cryptographic issues:\r\n\r\n- the current time isn't random at all and is easy to predict with a low error margin.\r\n\r\n- uniform isn't a cryptographically secured pseudo random number generator, given enough data (a few hundreds of session ids, nothing difficult to generate) it's easy to predict any further input.\r\n\r\n- the processor is not random either, it's possible to find it and once leaked it is very hard to change\r\n\r\n- sha1 is completely unsafe and should never be used. There is no good reason to use it today instead of sha256, sha512 or blake2.\r\n\r\nThe solution\r\n============\r\n\r\nA session id should be unique and cryptographically secure. Unfortunately D\r\ndoesn't currently provide a standard CSPRNG. I would recommend to take the\r\nsha256 of 64 bytes of your systems random number generator source :\r\n\r\n- /dev/urandom   on Linux/MAC\r\n- CryptGenRandom on Windows\r\n\r\nIf your system doesn't provide one of those refuse to compile! It's important\r\nnot to silently induce a fake sense of security.\r\n"},"comment":{"url":"https://api.github.com/repos/putaolabs/hunt/issues/comments/259947110","html_url":"https://github.com/putaolabs/hunt/issues/51#issuecomment-259947110","issue_url":"https://api.github.com/repos/putaolabs/hunt/issues/51","id":259947110,"user":{"login":"vegax87","id":5323124,"avatar_url":"https://avatars.githubusercontent.com/u/5323124?v=3","gravatar_id":"","url":"https://api.github.com/users/vegax87","html_url":"https://github.com/vegax87","followers_url":"https://api.github.com/users/vegax87/followers","following_url":"https://api.github.com/users/vegax87/following{/other_user}","gists_url":"https://api.github.com/users/vegax87/gists{/gist_id}","starred_url":"https://api.github.com/users/vegax87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vegax87/subscriptions","organizations_url":"https://api.github.com/users/vegax87/orgs","repos_url":"https://api.github.com/users/vegax87/repos","events_url":"https://api.github.com/users/vegax87/events{/privacy}","received_events_url":"https://api.github.com/users/vegax87/received_events","type":"User","site_admin":false},"created_at":"2016-11-11T12:26:19Z","updated_at":"2016-11-11T12:26:19Z","body":"Blake2 seems the best option for hashing, I hope that some devs will have time to port it on D language"}}
{"actor":{"display_login":"vegax87"}}