You'd still need to do the HMAC also, otherwise they could modify the session. Even if they're modifying in the dark, they could cause funny things to happen (eg imagine storing an id of a model which will be deleted...) - witness what happened to WEP when they forgot this.
I agree with you that this should be an option. But I think that even symmetric encryption is much slower than a simple HMAC - so there would be a performance hit. Brad Ediger wrote: > (apologies if this goes through multiple times, it's been almost 24 > hrs and I haven't seen my original post) > > First of all, I love the new cookie-based sessions. Thanks bitsweat. > I just have an architectural question / suggestion. > > The CookieStore takes great care to provide integrity of session > data, but we seem to have lost confidentiality in the process. The > server-side storage methods had the implicit advantage of keeping the > session data secret, but I don't know if this was intentional or just > an unintended consequence. > > Would anyone see a disadvantage to symmetrically encrypting the > cookie data rather than signing it with an HMAC? > > As far as I can think, this would retain all of the benefits of the > current arrangement while obscuring the session data from a > potentially untrusted client. (Not that untrusted-client is the > normal way of things, but I tend to think fail-secure.) I don't think > we need the full authenticity that an HMAC provides, since we're not > trying to prove session authenticity to anyone other than the server > that generated the session. > > Thanks! > --be > --Apple-Mail-37-430566699 > Content-Type: text/html; charset=ISO-8859-1 > Content-Transfer-Encoding: quoted-printable > X-Google-AttachSize: 7340 > > <HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; = > -khtml-line-break: after-white-space; "><DIV>(apologies if this goes = > through multiple times, it's been almost 24 hrs and I haven't seen my = > original post)</DIV><DIV><BR = > class=3D"khtml-block-placeholder"></DIV><DIV><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; ">First of all, I = > love the new cookie-based sessions. Thanks bitsweat. I just have an = > architectural question / suggestion.</SPAN></SPAN></SPAN></DIV><DIV><BR = > class=3D"khtml-block-placeholder"></DIV><DIV><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; ">The CookieStore = > takes great care to provide integrity of session data, but we seem to = > have lost confidentiality in the process. The server-side storage = > methods had the implicit advantage of keeping the session data secret, = > but I don't know if this was intentional or just an unintended = > consequence.=A0</SPAN></SPAN></SPAN></DIV><DIV><BR = > class=3D"khtml-block-placeholder"></DIV><DIV><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; ">Would anyone see a = > disadvantage to symmetrically encrypting the cookie data rather than = > signing it with an HMAC?=A0</SPAN></SPAN></SPAN></DIV><DIV><BR = > class=3D"khtml-block-placeholder"></DIV><DIV><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; "><SPAN = > class=3D"Apple-style-span" style=3D"border-collapse: separate; = > border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; = > font-size: 12px; font-style: normal; font-variant: normal; font-weight: = > normal; letter-spacing: normal; line-height: normal; text-align: auto; = > -khtml-text-decorations-in-effect: none; text-indent: 0px; = > -apple-text-size-adjust: auto; text-transform: none; orphans: 2; = > white-space: normal; widows: 2; word-spacing: 0px; ">As far as I can = > think, this would retain all of the benefits of the current arrangement = > while obscuring the session data from a potentially untrusted client. = > (Not that untrusted-client is the normal way of things, but I tend to = > think fail-secure.) I don't think we need the full authenticity that an = > HMAC provides, since we're not trying to prove session authenticity to = > anyone other than the server that generated the = > session.</SPAN></SPAN></SPAN></DIV><DIV><BR = > class=3D"khtml-block-placeholder"></DIV><DIV>Thanks!</DIV><DIV>--be</DIV><= > /BODY></HTML>= > > --Apple-Mail-37-430566699-- --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
