Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limit pubkey size in challenge request #48

Merged
merged 1 commit into from
Jan 19, 2024

Conversation

timweri
Copy link
Collaborator

@timweri timweri commented Jan 19, 2024

Limit the length of the public key string in the Challenge request to mitigate DoS risk.

Testing done on local DB:

  • Happy path of challenge request works. Was able to get challenge and register a FIDO key.
  • Modified Rustica CLI to send a long public key in the Challenge request. Without the pubkey size limit, I was able to fetch a challenge. With the pubkey size limit, the assert works:
[2024-01-19T07:15:32Z WARN  rustica::logging::stdout] The pubkey size is too large (543 chars) for a challenge request from [obelisk]

@timweri
Copy link
Collaborator Author

timweri commented Jan 19, 2024

@obelisk 512 chars might be too generous. Thoughts on 256?

ssh-certs requests ED25519 keys from the Yubikey, which is always 127 chars. Not sure if there's any case where there would be comment in the pubkey.

Rustica is tightly coupled with ssh-certs and ssh-certs always asks for ED25519 keys that are always 127 chars, we can even clamp it to < 128 chars.

@obelisk obelisk merged commit 630f638 into hacking_on_mozilla Jan 19, 2024
@timweri timweri deleted the limit-challenge-req-size branch March 2, 2024 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants