crossbario / crossbario/autobahn-python
Use secrets.choice and 600,000 iterations for WAMP-CRA keygen helper
Open
Nobody has claimed this yet.
bug
wamp
- Dominant language
- Python
- Stars
- 2.5k
- Forks
- 768
- PR merge metrics
- No merged PRs in 30d
Description
I've got some suggestions which may be useful and can help make it more secure.
- The "random.choice()" used here may be considered vulnerable because the "random" module is not suitable for cryptographic operations as it is not cryptographically secure.
Adopting "os.urandom" or functions from the 'secrets' module may be a feasible solution. - The default iteration for pbkdf2 should be at least 10000, while the current default iteration here is only 1000.
You can increase the iteration to at least 10000 to fix it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read autobahn/wamp/auth.py around lines 494 and 604, then trace the WAMP-CRA key-generation helper and its callers. Reconcile the issue's 600,000-iteration title with the body’s 10,000 minimum, and consider the work done when the agreed secure randomness and iteration defaults are reflected without breaking the helper.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100