[tor-bugs] #4303 [Company]: Tor controllers should check the length of authentication-cookie files

[Tor Bug Tracker & Wiki]

#4303: Tor controllers should check the length of authentication-cookie files
---------------------+------------------------------------------------------
 Reporter:  rransom  |          Owner:  phobos
     Type:  defect   |         Status:  new   
 Priority:  major    |      Milestone:        
Component:  Company  |        Version:        
 Keywords:           |         Parent:        
   Points:           |   Actualpoints:        
---------------------+------------------------------------------------------
Changes (by karsten):

  * type:  project => defect


Old description:

> Right now, our Tor controllers will send any file readable by the user to
> whatever is listening to the control port they try to connect to (usually
> 127.0.0.1:9051).  This sucks.  They should only send any file that is
> exactly 32 bytes long and readable by the user to whatever is listening
> on that port.  (Hopefully no one stores AES-256, Salsa20, or Curve25519
> secret keys (or other actually sensitive pieces of data) in raw 32-byte
> binary files.)
>
> Marking this as a ‘task’, not a ‘defect’, so it'll get a child ticket
> list.

New description:

 Right now, our Tor controllers will send any file readable by the user to
 whatever is listening to the control port they try to connect to (usually
 127.0.0.1:9051).  This sucks.  They should only send any file that is
 exactly 32 bytes long and readable by the user to whatever is listening on
 that port.  (Hopefully no one stores AES-256, Salsa20, or Curve25519
 secret keys (or other actually sensitive pieces of data) in raw 32-byte
 binary files.)

 [[TicketQuery(parent=#4303,format=table,col=summary|owner)]]

--

Comment:

 Changed ticket type to defect and added child ticket list to the
 description.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4303#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online