[SLING-10350] Use a stronger algorithm in TokenStore

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Form Based Authentication 1.0.20
• Fix Version/s: Form Based Authentication 1.0.24
• Component/s: Authentication
• Assignee: Eric Norman
• Reporter: Cris Rockwell
• Created: 04/May/21 21:25
• Updated: 12/Jun/21 01:32
• Resolved: 24/May/21 18:38

Description

The TokenStore in Forms uses SHA-1

final Mac m = Mac.getInstance(HMAC_SHA1);

https://github.com/apache/sling-org-apache-sling-auth-form/blob/e7cfa7827c9ce39d5f686556bb2555c83c335c3f/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java#L143

Cryptographic hash algorithms such as MD2, MD4, MD5, MD6, HAVAL-128, HMAC-MD5, DSA (which uses SHA-1), RIPEMD, RIPEMD-128, RIPEMD-160, HMACRIPEMD160 and SHA-1 are no longer considered secure, because it is possible to have collisions (little computational effort is enough to find two or more different inputs that produce the same hash).

The provisioning of weak security tokens for every request could be considered a security vulnerability. Also in a production environment with many active users, the risk of accidental collision is not impossible.

I don't recommend doing this before SLING-10290, because constant provisioning of the tokens is performance drain, and will be more so with a stronger algorithm.

Issue Links

• links to: PR #3