1

I am using itsdangerous to sign a string using a secret key. It says that the signing mechanism is HMAC and SHA1 and that it is an implementation of the Django signing module.

Assuming I use one secret key to sign many strings, and an attacker gets ahold of the full signature my string.wh6tMHxLgJqB6oY1uT73iMlyrOA (including the "my string" portion), how easy would it be for the attacker to brute force this and gain control of my secret key?

I assume the attacker could guess that I'm using itsdangerous and could spend money to provision a bunch of cloud servers.

Is this something I should be worried about?

  • It's roughly as safe as yoour key. If the attacker can guess/cruteforce your key, you've lost. – user155462 Aug 9 '17 at 15:48
3

From a short look at the module it is using a plain HMAC together with SHA-1 (or SHA-512 in newer versions). This is the same algorithm as used in TLS to detect data manipulation.

But a HMAC can be computed fast. The major costs in the HMAC are the hash computation (i.e. SHA-1 in your case) which is needed twice. This means that if you have a weak secret a brute-force attack is possible. And, while Signer seems to offer the use of a key derivation function to "harden" the key the offered functions are only a single hash or a HMAC (i.e. two hashes), which don't really slow down a brute-force attack.

This means that the security of this approach lies in choosing a good secret key, i.e. some long random string instead of a comparable short password. Unfortunately the documentation does not really show what keys are secure and only makes some recommendations similar to password recommendations:

Given a key only you know ... So if you keep the key secret and complex, you will be fine.

But from similar password recommendations we all know how secure such keys will be at the end. What you really should use is hidden in the source code in the documentation of derive_key:

def derive_key(self):
... Keep in mind that the key derivation in itsdangerous is not intended to be used as a security method to make a complex key out of a short password. Instead you should use large random secret keys.

The following would create a secret with 128 random bits which is sufficiently secure against brute-force attacks:

 import os
 secret_key = os.urandom(16)
  • I've discarded the answer I was working on: cause you beat me to it. Maybe you could add that the attack in the question is weaker than a Chosen Plaintext Attack, and good cryptosystems are supposed to be resistant to even an infinite number of chosen plaintexts – Mike Ounsworth Aug 9 '17 at 15:52
  • @MikeOunsworth: I cannot really follow your argumentation. I see chosen cipher plaintext attack in the context where the key is assumed to be hard enough (i.e. random) so that brute-force against the key will not work and flaws in the encryption algorithm are needed to compute the key. But in the context of this question one must assume that the secret key is weak and thus brute-force will work. If the secret is not weak (i.e. is long and random and well protected) the method should be safe against attacks. – Steffen Ullrich Aug 9 '17 at 16:19
  • Then I must be missing something because I don't see anything in the question implying that the key is weak, in fact I don't see anything in the question about the key at all. – Mike Ounsworth Aug 9 '17 at 16:37
  • @MikeOunsworth: The question itself does not make any assumptions about the key at all. But it links to the documentation where the only requirements are that it is a "key only you know" and you have to "keep the key secret and complex". That unfortunately sounds very similar to recommendations for choosing passwords and we know how weak these are in practice anyway. A much better recommendation there would be to generate a random strings of 128 bits or similar for the key and even better show how to do it. – Steffen Ullrich Aug 9 '17 at 16:58
  • 1
    @JustinKrause: To brute-force 128 random bits within 10 years you would need on average 5*10^29 tries per second. Even if every try would only be a single CPU instruction you would need a processor which is more than 100.000.000.000.000.000.000 times faster than current processors. In other words: highly unlikely. But if you think that you have an extremely lucky attacker you could of course use even more random bits. – Steffen Ullrich Aug 9 '17 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.