From: Adam (spamme.adam@gmail.com)
Date: Wed Dec 20 2006 - 16:16:32 EST
How much entropy should a web application session ID have?
Obviously, the answer is, "it depends".
In the past, I've used symmetric crypt key lengths as a comparison,
but am I being too tough on the developer? I'd like to have some
justification behind a finding that says, "Your session ID size of XX
bits is not big enough".
So here are the factors that I've come up with (for the purposes of
this discussion, lets assume we've got a decent PRNG that is
generating the session IDs):
- How many concurrent sessions does the web application usually have?
(this is important if the attacker is happy to hijack *any* session,
as opposed to a *specific* session)
- Session expiration timeout and typical length of a user session
(important if the attacker is looking to hijack a specific session)
- How many concurrent guesses could the web app sustain before
crashing? (ie. will 50,000 guesses/sec from my bot army crash the
server long before I can hijack a session?)
- Is the web app infrastructure protected by an IPS product (that works)?
So, does anyone out there have any good algorithms/calculations for
justifying a particular amount of entropy in a session ID?
...and just to re-emphasize, for the purposes of this discussion, lets
assume we've got a decent PRNG that is generating the session IDs.
thanks,
Adam
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:29 EDT