envoyproxy / envoyproxy/envoy

Crypto-grade hashing for resource sharing

Open
#11,967 6 comments 0 reactions 0 assignees View on GitHub
area/security area/xds bug help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

Currently, we use `MesasgeUtil::hash` in various places, e.g. SDS, to hash a config source (https://github.com/envoyproxy/envoy/blob/master/source/common/secret/secret_manager_impl.h#L82).

Since our threat model has the control plane as trusted, this isn't a huge issue. But if we make the control plane untrusted in the future, this can be somewhat scary. As an example, imagine an Envoy that has delegated listener config (with SDS) to TrustedControlPlane and another listener config (with SDS) to SuperScaryControlPlane. It's plausible that SuperScaryControlPlane is able to engineer a collision and steal secrets via the dynamic prover's dedupe algorithm, since we're only using the weak `xxhash`.

This is something we probably should fix before considering Envoy robust to untrusted control plane or ready for arbitrary federation.

CC @antoniovicente @kyessenov

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.