Re: [RFC] Secure Session Module Options by Default

Hi all, On Sun, Feb 2, 2014 at 7:33 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > Secure Session Module Options by Default > https://wiki.php.net/rfc/secure-session-options-by-default > > Session is core of web security. Therefore, default should be > as secure as possible by default. > > I'll open vote next week, please send comments now. > As many of already knew, use of SHA-1 is deprecated for security related use by NIST. "applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010. " http://csrc.nist.gov/groups/ST/hash/policy_2006.html Current files save handler detects collision and it is out of NIST requirement regardless of hash function. Collision detection is up to save handler now. It could be check with newer session module code using PS_VALIDATE_SID_FUNC(). This API is included in the patch for https://wiki.php.net/rfc/session-lock-ini If 3rd party save handler supports PS_VALIDATE_FUNC(), collision detection can be done at session module. This RFC may be better to include this change (collision detection) also. AND/OR We may use SHA-256 as the default. This may be preferred since NIST discourages use of SHA-1 anyway. Regards, P.S. It may be too late to change. SHA-3 is coming now. -- Yasuo Ohgaki yohgaki@ohgaki.net