Shibboleth SP and IdP v2 Session ID algorithm

[Cantor, Scott]

On 10/21/15, 11:13 AM, "users on behalf of Robert Eastman - US" <users-bounces at shibboleth.net on behalf of reastman at caci.com> wrote:


>
>I searched but didn't find any info on how the Shibboleth SP/IdP session ID is generated.

It's an implementation detail. There are many session IDs and we don't control all of them.

Anything the IdP does is usually done with SecureRandom in Java, but that's a very deep topic that has also undergone lots of changes across Java versions (one recently I think).

I don't know what containers use. Those sessions matter a great deal in V3. They didn't matter in V2.

The SP uses a lot of layers that ultimately end up calling into OpenSSL. It's fairly difficult to guarantee any sort of proper seeding of that layer, and the SP doesn't get into that business. It can be done if the deployer does it. I don't know how safe it is by default, that would be an OpenSSL library question.

>What type of algorithm generates the session ids? I have a security check that needs to confirm the random number generator algorithm is FIPS 140-2 compliant.

FIPS and open source are basically incompatible. The SP is in no way FIPS compliant and could never be. The IdP is in Java, and there's a lot of hand waving around it in that domain, so probably the sorts of people that believe in these things would consider it compliant.

-- Scott