Shibboleth SP and IdP v2 Session ID algorithm

[Brent Putman]

On 10/21/15 11:13 AM, Robert Eastman - US wrote:
>
>
> I searched but didn't find any info on how the Shibboleth SP/IdP
> session ID is generated.
>

I don't recall anyone ever asking.  I'm sure we've always treated it
(at least for the IdP) as an internal implementation detail, so we by
definition wouldn't document it, because we're free to change it.  It's
not API.


>
> What type of algorithm generates the session ids? I have a security
> check that needs to confirm the random number generator algorithm is
> FIPS 140-2 compliant.
>

For the IdP, see class
edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl.

It just uses Java's SecureRandom.  Basically like this:


// Instantiated once per instance of SessionManagerImpl
private final SecureRandom prng = new SecureRandom();


// on each createSession()
byte[] sid = new byte[sessionIDSize];
prng.nextBytes(sid);
String sessionID = Hex.encode(sid);


According to the Javadocs, that style of getting a SecureRandom works
like this:

     * <p> This constructor traverses the list of registered security
Providers,
     * starting with the most preferred Provider.
     * A new SecureRandom object encapsulating the
     * SecureRandomSpi implementation from the first
     * Provider that supports a SecureRandom (RNG) algorithm is returned.
     * If none of the Providers support a RNG algorithm,
     * then an implementation-specific default is returned.
     *


So that actual impl used at runtime is going to depend on the presence
and ordering of the Java security providers configured in java.security
that expose impls of the SecureRandom service.

I personally don't know anything about FIPS 140-2 compliance wrt the
standard/common providers.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151021/8d288285/attachment-0001.html>