[NIFI-3367] TLS Toolkit should enforce minimum length restriction on CA token

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.1
• Fix Version/s: 1.6.0
• Component/s: Tools and Build
• Labels: security tls-toolkit
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 18/Jan/17 20:06
• Updated: 10/Feb/18 01:47
• Resolved: 10/Feb/18 01:47

Description

The TLS Toolkit uses a shared secret "token" when running in client/server mode in order to perform pre-authentication when requesting a signed certificate from the CA. There is a validation that this token is required, but not that it is of a certain length. Because the HMAC construction is available in the source code, the process could easily be brute-forced if the token value is short. We should enforce a minimum length of 16 bytes (regardless if read from config.json or provided via command line).

We may also want to add exponential rate-limiting on failed HMAC values for the same requested public key DN in order to mitigate malicious requests.

Issue Links

• links to: GitHub Pull Request #2463