Hi all,
On Sun, Feb 2, 2014 at 7:33 AM, Yasuo Ohgaki <[email protected]> wrote:
> Secure Session Module Options by Default
> https://wiki.php.net/rfc/secure-session-options-by-default
>
> Session is core of web security. Therefore, default should be
> as secure as possible by default.
>
> I'll open vote next week, please send comments now.
>
As many of already knew, use of SHA-1 is deprecated for security related
use by NIST.
"applications that require collision resistance as soon as practical, and
must use the SHA-2 family of hash functions for these applications after
2010. "
http://csrc.nist.gov/groups/ST/hash/policy_2006.html
Current files save handler detects collision and it is out of NIST
requirement regardless of hash function. Collision detection is up to save
handler now. It could be check with newer session module code using
PS_VALIDATE_SID_FUNC(). This API is included in the patch for
https://wiki.php.net/rfc/session-lock-ini
If 3rd party save handler supports PS_VALIDATE_FUNC(), collision detection
can be done at session module.
This RFC may be better to include this change (collision detection) also.
AND/OR
We may use SHA-256 as the default.
This may be preferred since NIST discourages use of SHA-1 anyway.
Regards,
P.S. It may be too late to change. SHA-3 is coming now.
--
Yasuo Ohgaki
[email protected]