[CSRF]高木氏のエントリへの返答 
- CSRF対策に「ワンタイムトークン」方式を推奨しない理由 @ 高木浩光＠自宅の日記
ものすごく遅くなってしまったが、高木氏の反論を読ませて頂いた。
ワンタイムトークン方式の欠陥
(拙作の)「ワンタイムトークン方式」では複数の画面遷移を実装できない、という点についてはまさにその通りで反論の余地はない。僕が提唱した方法では、同一セッションで2つ以上の画面遷移を平行して行った場合、先にワンタイムトークンを発行した方の処 理がエラーを起こしてしまう。
「ワンタイムトークンを変数で切り分ける」方式(僕が提唱したものではないが)についても、高木氏の言う通りで現実的ではないと思う。全く同じ画面の平行編集についても、同じ人へ複数のメッセージ(メール)を送る場合など必要と思われる場面はいくつか想定できる。
で、hiddenにSessionIDを入れるのは問題ないの？
高木氏やおおいわ氏の主張は、まず「hiddenの値が漏れる」という状況がブラウザのバグやクラックによるものだということを前提とし、CSRF対策とは直接の関連がないという主旨だと理解しているのだが、一旦「hiddenの値が漏れた」場合、その被害はCSRFに留まらずセッションハイジャックにも繋がるものでブラウザのバグだろうとこれを軽視すべきではないというのが僕の主張だ。
通常Cookieに埋めるSessionIDをhiddenに「も」埋めるのだから危険性は「Cookieが漏れる可能性」＜「Cookieが漏れる可能性+Hiddenが漏れる可能性」となりSessionID漏洩のリスクが高くなると考えるのが妥当だろう。もちろんCookieが安全と言っているわけではない。両方に埋めればそれだけリスクが増すと言っているに過ぎない。
CSRF用トークンが漏れた場合、発生するリスクはCSRFである。hiddenが漏れたのなら被害はCSRFに留まらないかもしれない。確かにこれは大きな脅威である。しかし他方、SessionIDが(CSRF対策のキーとして)漏れた場合は、その大きな脅威に「加えて」セッションハイジャックの脅威も発生する。後者の方がリスクが高いのは自明ではなかろうか。
なお、おおいわ氏はCSRF と CSSXSS に関する議論についてで、「『session ID 方式は現状でずば抜けて危険である』とか、 逆に『session IDでなければ漏れた際の被害が少なく、有意に安全である』という積極的主張は(snip)不適当であると私は考える。」としているが、これについては賛同できる。ここで確認しておきたいのは、僕の主張としては、危険性は「SessionID方式＞(SessionIDと同等かそれ以上に推測困難な)ワンタイムトークン方式」であるということだ。
セッションハイジャックとCSRFの脅威は同じ？
高木氏は「セッションハイジャックとCSRFの脅威は同じだ」としているが、これは違う。CSRFは基本的に善意の利用者が悪意のサイトを閲覧した時にのみ発生する。利用者が異常に気付きブラウザを閉じればそれ以降は攻撃は不可能となる。他方、セッションハイジャックは攻撃者が認証の通った状態で自由にアクセスすることができるため、たとえユーザーがパソコンの電源を引き抜いたとしても、セッションが破棄されない限り攻撃は継続可能である。
CSRFはサーバー側から見るとあたかも「ユーザー自身が操作した」ように見えるため、セッションハイジャックよりも深刻な問題を引き起こす可能性はあるが、以上の理由で「脅威が同一」であることはない。
それ以前に「脅威が同じであるから問題ない」という論自体が誤謬である。「問題ない」とするには、「脅威も発生する条件も同じ」でなければならない。もし「脅威が同じ」であると仮定しても、両者は発生する条件が異なるので依然としてSessionIDをhiddenに入れることが安全であるとは言えない。
例えばhiddenの内容は読み取れてもCSRF攻撃はできないという状況も存在するだろう。hiddenの内容を読み取って然る後にCSRF攻撃を仕掛けるにはなんらかの画面遷移が必要だが、ユーザーがこれに引っかからない可能性がある。しかしhiddenの内容がSessionIDであるならば、CSRFに失敗したところでセッションハイジャック攻撃を仕掛けることが依然として可能となる。
逆に、Cookieの内容(のSessionID)は読み取れてもセッションハイジャック攻撃は行えないという状況もあるだろう。サイトによってはSessionIDとアクセス元のIPアドレスを照合して合致しない場合はアクセスを拒否するという対策を行っているところがある。(この対策の是非はおいとくとして)こういったサイトではセッションハイジャックは難しい。しかし、CSRFは善意のユーザーのIPアドレスからのアクセスとなるため当然IPアドレスのチェックは通過してしまう。
CSRFキーにSessionID以外の値を使えば、上述のような脅威に晒されることはない。
hiddenに個人情報を入れるのは安全？
最も気になったのが、「hiddenパラメタは漏れやすいのか？」についてである。これは私は「漏れやすい」と認識している。高木氏は例として個人情報の送信を挙げているが、今時平文で住所や電話番号を送信させるところはないだろう(と信じたい)から、これはSSLを使用することが前提になるだろう。httpsスキームでは、そもそもドキュメント全文が秘密の対象になるのだから、ドキュメントそのものが他人に読まれないように処置が取られているのが普通である。当然hiddenパラメタが漏れることも少ないだろう。
しかしCSRFはSSLを使うまでもないサービス(このblogとか)にも適用されるものなのだから、個人情報を引き合いに出すのは適当でない。では、hiddenに入れられて読まれると困る例はなんだろうか。その1つがパスワードであろう。このBlogにしろ、それほど大きくないコミュニティサイトにしろ、SSLを介さずにパスワードのやりとりが行われているものは多いが、パスワードをhiddenにそのまま入れるようなことがあるだろうか。
調べてみたところ、パスワードに関してはSSLを用いているか、「確認画面」を遷移せず、そのまま「パスワードが変更されました」画面に遷移するサイトが多い(mixiは平文でhiddenに思いっきりパスワードが埋められていたが)。ちなみにPEARのHTML_QuickFormも、<input>のtype=passwordに限ってはhiddenを出力しない設計になっている。
個人的には、httpsスキーム等は別として、パスワードにしろ個人情報にしろSessionIDにしろ「読まれて困るものは極力hiddenには入れない」というのがポリシーとしてあるのだが、これは一般的ではないのだろうか。
なお、擬似乱数の問題については、僕が提唱した例ではPHPがSessionIDを生成するのに使用しているロジックをそのまま継承しているので、この堅牢性はSessionIDの堅牢性に準じ、特に問題はないと考えている。ただこの点については注記すべきだったかも知れない。
ではどうすればいいのか
前述したように、僕が最初に提唱したワンタイムトークン方式では、1つの画面遷移に1つのワンタイムトークンを発行していたので、複数の画面遷移を平行して行うことができないという欠点があった。この欠点を埋める方法として、セッション発行時にワンタイムトークンを発行し、その値をセッションに関連付けて同一セッション内で使いまわすという方法が考えられる(SessionIDに関連したSessionIDが推測不可能な情報という点では、SessionIDのハッシュ方式に近い原理)。
また画面遷移ごとにトークンを発行するのであれば、画面遷移開始時に予測不可能な文字列を生成してこれをキーとし、値として別の予測不可能な文字列を生成してこれをワンタイムトークンとし、このキーと値の組をサーバー側に保持すれば確実に画面遷移を追うことができるのではなかろうか。
ただこの2つの方法については安全性の考察を始めたばかりなので欠陥があるかも知れない。ツッコミ歓迎なのでなにか勘違いしている部分があれば指摘して頂きたい。
SessionIDのハッシュを取る方法に関しては、高木氏より反論があるようなので、そちらを待ちたいと思う(*1)。
追記
(4/28) 上の2つの方法は、既に高木氏が同エントリで指摘していた。
トークンはログインセッションで共通の1個でよいことがわかる。(snip) 既に図5の実装をしているならば、CSRF対策はウィンドウIDを予測困難な値にすればよい。
(4/28) 「セッションハイジャックとCSRFの危険性は同じ？」の項を追加した。
(*1)(5/8) 単にセッションIDのハッシュを取っただけのものをCSRFキーに使用するのは確かに危険。セッションIDが漏洩した場合、同時にCSRF攻撃も可能となってしまうため。ハッシュを取るならアプリケーションでユニークかつ予測不可能な文字列をハッシュの種に加える必要があるだろう。
2011/12/09 - 17:30:09 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/09 - 18:14:38 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/10 - 01:27:07 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/10 - 05:57:23 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/10 - 07:25:14 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/10 - 07:28:16 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/10 - 08:18:05 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/10 - 10:22:21 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/10 - 10:56:54 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/10 - 10:57:41 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/10 - 11:25:46 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/10 - 12:41:16 -
Looking around
I love to surf around the online world, often I will go to Digg and read and check stuff out
2011/12/10 - 13:08:56 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/10 - 15:04:02 -
Just Looking
When I was surfing yesterday I noticed a excellent article concerning
2011/12/10 - 20:58:19 -
Links…
[…]Sites of interest we have a link to[…]……
2011/12/11 - 01:44:43 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/11 - 03:06:36 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/11 - 06:36:12 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/11 - 09:08:30 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/11 - 09:09:04 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/11 - 12:09:10 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/11 - 16:01:21 -
Bing results
While browsing Bing I discovered this page in the search results and I didn’t think it match
2011/12/11 - 19:43:16 -
Cool sites…
[…]we came across a cool site that you might enjoy. Take a look if you want[…]……
2011/12/11 - 22:07:20 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/11 - 22:12:19 -
abomasal
Thank you Jean Techwork recently posted..Take control of your PC with Autoruns from Sysinternal
2011/12/11 - 23:02:00 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/12 - 01:43:42 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/12 - 01:47:15 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/12 - 03:44:08 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/12 - 05:10:29 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/12 - 12:52:18 -
Interesting….
A very unique post.
2011/12/12 - 14:09:47 -
Superb website…
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]……
2011/12/12 - 16:03:56 -
free dating service
Hello there, just became alert to your blog through Google, and found that it is truly informative. I am gonna watch out for brussels. I will be grateful if you continue this in future. Many people will be benefited from your writing. Cheers!
2011/12/12 - 17:07:54 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/12 - 19:24:41 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/12 - 19:51:35 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/12 - 21:23:03 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/12 - 21:42:34 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/13 - 00:13:22 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 03:03:26 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/13 - 03:56:44 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/13 - 06:36:41 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/13 - 07:38:33 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/13 - 09:14:15 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/13 - 09:37:23 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/13 - 10:51:55 -
Interesting….
A very neat post.
2011/12/13 - 12:36:28 -
With havin so much written content do you ever run into any problems of plagorism or copyright infringement? My blog has a lot of unique content I’ve either written myself or outsourced but it seems a lot of it is popping it up all over the internet without my authorization. Do you know any methods to help protect against content from being ripped off? I’d genuinely appreciate it.
2011/12/13 - 15:05:41 -
Tumblr
Tumblr linked to this website
2011/12/13 - 16:00:20 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 16:58:30 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/13 - 18:30:46 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/13 - 23:40:54 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/14 - 01:40:47 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/14 - 02:22:31 -
It is quite hard to find good help
I am really forever saying that its difficult to find quality honest help, but here is
2011/12/14 - 03:10:21 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/14 - 06:16:14 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/14 - 10:17:41 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/14 - 10:20:18 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/14 - 11:45:02 -
Yahoo News
When checking out Yahoo News today I noticed this
2011/12/14 - 16:42:55 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/14 - 17:21:48 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/14 - 19:07:28 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/14 - 19:26:44 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/14 - 20:15:44 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 20:32:30 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/14 - 22:04:42 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/14 - 22:17:17 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/14 - 22:57:17 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 23:30:35 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/15 - 01:45:33 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 02:01:15 -
……..
We suppose for the present time i will be satisfied with bookmarking and adding your current Rss to be able to my Google consideration. I look ahead to new improvements and definately will share this website using our Fb class.
2011/12/15 - 03:43:19 -
Tumblr
Tumblr linked to this website
2011/12/15 - 06:42:10 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/15 - 07:50:51 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/15 - 08:45:53 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 15:47:39 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/15 - 17:07:04 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 17:23:39 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/15 - 17:29:29 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/15 - 17:36:23 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/15 - 17:56:34 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/15 - 18:15:02 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/15 - 18:37:16 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/15 - 18:59:04 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 19:03:36 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/15 - 19:23:12 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 22:44:39 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 23:56:01 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/16 - 00:30:21 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/16 - 00:38:19 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/16 - 00:47:06 -
News
I was reading the Yahoo news and I saw this really cool information
2011/12/16 - 01:34:07 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/16 - 02:08:44 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/16 - 04:52:22 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/16 - 05:01:12 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/16 - 07:57:45 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/16 - 08:25:30 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/16 - 08:43:33 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/16 - 08:59:09 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/16 - 09:07:09 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/16 - 09:23:43 -
……..
My partner and i guess for the time being i am going to be happy with book-marking and also adding the Rss to my personal Yahoo accounts. My spouse and i enjoy new revisions and will talk about this specific blog along with my Facebook team.
2011/12/22 - 18:34:44 -
Hey! I know this is somewhat off topic but I was wondering which blog platform are you using for this site? I’m getting fed up of Wordpress because I’ve had problems with hackers and I’m looking at options for another platform. I would be awesome if you could point me in the direction of a good platform.