Azure / Azure/azure-relay

Improper handling of the base64-encoded signing key

Open
#57 0 comments 0 reactions 1 assignee Claimed by @jbjordan View on GitHub
enhancement
Dominant language
No language data
Stars
88
Forks
88
PR merge metrics
No merged PRs in 30d

Description

# Description
Hybrid Connections generate signing keys that are base64 encoded, but then expect the client to grab that base64-encoded string, take the underlying bytes and sign the token with that.

Here's an example of a client that probably works, but is wrong: https://github.com/Azure/azure-relay-dotnet/blob/dev/src/Microsoft.Azure.Relay/Common/TokenProvider.cs#L16

A client that is implemented correctly and first decodes the base64-encoded key fails to authenticate.

I'm no cryptographer, but could this have some impact on the strength of your security?

Here's Azure documentation stating that the keys are base64-encoded: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-sas#overview-of-sas

## Actual Behavior
1. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with a properly decoded base64 key.
2. Azure responds with an Invalid Signature error.
3. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with the bytes of the base64-encoded string.
4. Authentication succeeds.

## Expected Behavior
The reverse of the actual behavior.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.