[tor-bugs] #11215 [BridgeDB]: Add timestamp/expiry to HMAC verification code in BridgeDB's local CAPTCHAs

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#11215: Add timestamp/expiry to HMAC verification code in BridgeDB's local CAPTCHAs
-------------------------------------------------+-------------------------
 Reporter:  isis                                 |          Owner:  isis
     Type:  defect                               |         Status:  new
 Priority:  major                                |      Milestone:
Component:  BridgeDB                             |        Version:
 Keywords:  bridgedb-https, security,            |  Actual Points:
  bridgedb-0.1.6, easy                           |         Points:
Parent ID:                                       |
-------------------------------------------------+-------------------------
 The CAPTCHAs created in #10809 are in the form:
 {{{
 HMACFn := HMAC(HMAC_KEY, REQUEST_IP_ADDR)
 CAPTCHA_VERIFICATION := HMACFn(RSA_ENC(CAPTCHA_ANSWER))
 }}}

 When they really should be more like:
 {{{
 HMACFn := HMAC(HMAC_KEY, REQUEST_IP_ADDR)
 CAPTCHA_VERIFICATION := HMACFn(TIMESTAMP, RSA_ENC(CAPTCHA_ANSWER))
 }}}

 See
 [https://gitweb.torproject.org/bridgedb.git/commitdiff/eeb6956ed7f7ddd0f2592c17f4a5d58a580fb878
 this commit message] from the original branch. After adding the timestamp
 to the `CAPTCHA_VERIFICATION` creation in
 `bridgedb.captcha.GimpCaptcha.createChallenge()`, said timestamp should
 obviously be checked that it is not expired (according to some easily
 configurable expiration period) in
 `bridgedb.captcha.GimpCaptcha.checkSolution()`.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/11215>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs