Penetration Testing mailing list archives
How much entropy in a web app session ID?
From: Adam <spamme.adam () gmail com>
Date: Wed, 20 Dec 2006 16:16:32 -0500
How much entropy should a web application session ID have? Obviously, the answer is, "it depends". In the past, I've used symmetric crypt key lengths as a comparison, but am I being too tough on the developer? I'd like to have some justification behind a finding that says, "Your session ID size of XX bits is not big enough". So here are the factors that I've come up with (for the purposes of this discussion, lets assume we've got a decent PRNG that is generating the session IDs): - How many concurrent sessions does the web application usually have? (this is important if the attacker is happy to hijack *any* session, as opposed to a *specific* session) - Session expiration timeout and typical length of a user session (important if the attacker is looking to hijack a specific session) - How many concurrent guesses could the web app sustain before crashing? (ie. will 50,000 guesses/sec from my bot army crash the server long before I can hijack a session?) - Is the web app infrastructure protected by an IPS product (that works)? So, does anyone out there have any good algorithms/calculations for justifying a particular amount of entropy in a session ID? ...and just to re-emphasize, for the purposes of this discussion, lets assume we've got a decent PRNG that is generating the session IDs. thanks, Adam
Current thread:
- How much entropy in a web app session ID? Adam (Dec 20)
- Re: How much entropy in a web app session ID? Tim (Dec 21)