From 45c7f427ce830dd1b2f636fb9c244fda9201cadb Mon Sep 17 00:00:00 2001 From: Luke Plant Date: Thu, 14 Oct 2010 20:54:30 +0000 Subject: Fixed #14445 - Use HMAC and constant-time comparison functions where needed. All adhoc MAC applications have been updated to use HMAC, using SHA1 to generate unique keys for each application based on the SECRET_KEY, which is common practice for this situation. In all cases, backwards compatibility with existing hashes has been maintained, aiming to phase this out as per the normal deprecation process. In this way, under most normal circumstances the old hashes will have expired (e.g. by session expiration etc.) before they become invalid. In the case of the messages framework and the cookie backend, which was already using HMAC, there is the possibility of a backwards incompatibility if the SECRET_KEY is shorter than the default 50 bytes, but the low likelihood and low impact meant compatibility code was not worth it. All known instances where tokens/hashes were compared using simple string equality, which could potentially open timing based attacks, have also been fixed using a constant-time comparison function. There are no known practical attacks against the existing implementations, so these security improvements will not be backported. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/internals/deprecation.txt | 4 ++++ docs/ref/contrib/formtools/form-wizard.txt | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt index f4ebadd6f4..c227f9ab5c 100644 --- a/docs/internals/deprecation.txt +++ b/docs/internals/deprecation.txt @@ -114,6 +114,10 @@ their deprecation, as per the :ref:`Django deprecation policy :class:`~django.test.simple.DjangoTestRunner` will be removed in favor of using the unittest-native class. + * The undocumented function + :func:`django.contrib.formtools.utils.security_hash` + is deprecated, in favour of :func:`django.contrib.formtools.utils.form_hmac` + * 2.0 * ``django.views.defaults.shortcut()``. This function has been moved to ``django.contrib.contenttypes.views.shortcut()`` as part of the diff --git a/docs/ref/contrib/formtools/form-wizard.txt b/docs/ref/contrib/formtools/form-wizard.txt index ab7b4829c9..1bc4fa894c 100644 --- a/docs/ref/contrib/formtools/form-wizard.txt +++ b/docs/ref/contrib/formtools/form-wizard.txt @@ -240,7 +240,7 @@ Advanced ``FormWizard`` methods Calculates the security hash for the given request object and :class:`~django.forms.Form` instance. - By default, this uses an MD5 hash of the form data and your + By default, this generates a SHA1 HMAC using your form data and your :setting:`SECRET_KEY` setting. It's rare that somebody would need to override this. -- cgit v1.3