Assume I’m using the following code to generate pseudo-random sessionID’s:
sessionID = SHA-512(GENERATE-GUID())
The GUIDs are pretty deterministic, i.e. I see lots of GUIDs with a lot of the same hexadecimals.
My simple question is: How deterministic are my resulting sessionID’s?
The algorithms for SHA are supposed to create very different hashes even if a small number of bits are different due to its cascading effect, so how easily could you “guess” (within reasonable time) another sessionID from the resulting hashes?
6
I would suggest you use an implementation of session id, that is known to be secure. Also there’s RFC about UUID/GUID http://www.ietf.org/rfc/rfc4122.txt where you can learn that there are different versions of GUIDs. I suggest you switch to cryptographycaly secure random numbers.
They are completely random (an UUID consists of 16 octets, some bits of which are fixed and some fully random), so they are nōndeterministic – and not guaranteed to be unique (especially if your random source is flawed).
A better way to generate unique session IDs (which is what I assume you want/need) is to use a counter (such as the PostgreSQL PRIMARY KEY SERIAL of the session table you use) and hash that with a per-installation-of-your-app secret. (Remember to protect your cookies with a MAC, e.g. a HMAC, and to use a different(!) secret for that.)
Also: UUIDs are 16 bytes, which is 128 bit, so there’s no point in hashing them into something longer than 128 bit.
Clarification: I mean something like this:
$handle = db_query_params('INSERT INTO session (remote_ip, begin, …) VALUES ($1, $2, …)',
array($remote_ip, now(), …));
$seqnumber = db_insertid($handle); /* find out which SERIAL PostgreSQL assigned to the session */
$session_id = sha512($somesecret . $seqnumber);
7