Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Dangerous, a Python cryptographic signing module

packages.python.org

Post reply on HN
Print view View original

11–20 of 60 posts

Re: It's Dangerous, a Python cryptographic signing module

#11

Post by fluffyllemon »

jacques_chester wrote: post #5
ctz wrote: post #3

Use of SHA-1 for this signature/MAC purposes in new applications is deprecated and will be disallowed from next year (source: NIST). I repeat: do not use SHA-1 in new applications. Do not use this module.

To clarify very slightly, use SHA-256, SHA-384 or SHA-512 instead. Sometime soon I believe SHA-3 will be chosen and we'll all be able to move onto that.

For those interested, NIST (National Institue of Standards and Technoology) announced a competition to find candidates for the SHA-3 algorithm back in November 2007:

"NIST also plans to host a final SHA-3 Candidate Conference in the spring of 2012 to discuss the public feedback on these candidates, and select the SHA-3 winner later in 2012." [http://csrc.nist.gov/groups/ST/hash/sha-3/Round3/index.html]

The final SHA-3 Candidate Conference was held March 22-23, so they should be picking the winner any day now.

Re: It's Dangerous, a Python cryptographic signing module

#12

Post by ebiester »

gambler wrote: post #9
Luit wrote: post #6

Earlier quoted context omitted.

Well then fork it and make it use HMAC with SHA256/512... Additionally, "Do not use this module" is bad advice if it leads to someone making their own MAC implementation, because that's almost always a bad idea. HMAC-SHA1 still is good security for this purpose. I bet that as soon as standards bodies (like NIST) actively encourage you to use better hash functions (which they will probably do soon) the developer of th…

You advise to "fork it", but immediately after that you add the notorious "do not write your own" meme. Can you see the inconsistency of the messages? Part of security is being up-to-date in regards to things like hashes. If authors don't update their own libraries and you need to tweak them manually, how is it different from "writing your own"?

I always thought the advice against "writing your own" spoke of the algorithm itself, not a library around the algorithm.

Re: It's Dangerous, a Python cryptographic signing module

#14

Post by [deleted] »

JoachimSchipper wrote: post #4
obiterdictum wrote: post #2

Executive summary: - The signature: SHA1 HMAC of data and, optionally, a timestamp to expire signatures. - HMAC key derivation: SHA1 of a secret key and a salt.

> - HMAC key derivation: SHA1 of a secret key and a salt. Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

[deleted]

Re: It's Dangerous, a Python cryptographic signing module

#15

Post by ibotty »

JoachimSchipper wrote: post #4
obiterdictum wrote: post #2

Executive summary: - The signature: SHA1 HMAC of data and, optionally, a timestamp to expire signatures. - HMAC key derivation: SHA1 of a secret key and a salt.

> - HMAC key derivation: SHA1 of a secret key and a salt. Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

... when will they ever learn...

Re: It's Dangerous, a Python cryptographic signing module

#16

Post by atto »

ctz wrote: post #3

Use of SHA-1 for this signature/MAC purposes in new applications is deprecated and will be disallowed from next year (source: NIST). I repeat: do not use SHA-1 in new applications. Do not use this module.

I forked the project and updated the hashing algorithm: https://github.com/andrewconner/itsdangerous

Re: It's Dangerous, a Python cryptographic signing module

#17

Post by the_mitsuhiko »

Luit wrote: post #8
ch0wn wrote: post #7

Earlier quoted context omitted.

It shouldn't be more than changing those two lines: https://github.com/mitsuhiko/itsdangerous/blob/59f3bf7877e21... And the tests, of course.

My point exactly! Armin (the maker/maintainer of the module) will probably consider doing this somewhere in the future.

I just pushed out a release that makes it possible to override the digest in a subclass easier.

Re: It's Dangerous, a Python cryptographic signing module

#18

Post by the_mitsuhiko »

ctz wrote: post #3

Use of SHA-1 for this signature/MAC purposes in new applications is deprecated and will be disallowed from next year (source: NIST). I repeat: do not use SHA-1 in new applications. Do not use this module.

> I repeat: do not use SHA-1 in new applications.

Probably, but not necessarily. It's not like the other sha versions are fixing the overall problem however.

> Do not use this module.

Even before the 0.13 release I just pushed out where you can override the module easier you could still easily change the hash method with a two line change. Also it's not like maintainers can't change things easily if modules are well defined.

And even if the module would not allow changing the hash method easily SHA1 with HMAC is still incredibly hard to exploit.

Re: It's Dangerous, a Python cryptographic signing module

#19

Post by the_mitsuhiko »

JoachimSchipper wrote: post #4
obiterdictum wrote: post #2

Executive summary: - The signature: SHA1 HMAC of data and, optionally, a timestamp to expire signatures. - HMAC key derivation: SHA1 of a secret key and a salt.

> - HMAC key derivation: SHA1 of a secret key and a salt. Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

> Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

PBKDF2 for this would be possible, but a terrible idea. The reason why PBKDF2 works for password verification purposes on web apps is because you can rate limit the login entry point. Doing that for sessions or activation links like what you would use itsdangerous for is an easy way to have other people DDOS your app.

PBKDF2/bcrypt etc. is not the solution for this problem.

Re: It's Dangerous, a Python cryptographic signing module

#20

Post by the_mitsuhiko »

ibotty wrote: post #15
JoachimSchipper wrote: post #4

Earlier quoted context omitted.

> - HMAC key derivation: SHA1 of a secret key and a salt. Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

... when will they ever learn...

> ... when will they ever learn...

When will some people on hackernews ever learn to start using their brain. PBKDF2 is not what you use to verify signatures. I think the name should already give that away.

//EDIT: and when will I ever learn to read properly. I just realized that the comment was referring to the "salt" part, not the signature.

Post reply on HN