Supporting multiple SSO secrets with Discourse as provider

Contribute Feature
,
2

I am quite a fan of key agility, and this provides a mechanism to do that (at least the “do it properly” approach). I think the quick hack method is a really bad idea, for several reasons:

  • You’d presumably have to be sending out both signatures all the time, which is wasteful for all those clients not requiring the extra signature;
  • k+consumer.hostname is equivalent to k in any circumstance in which the attacker can influence the value of consumer.hostname.
  • Conversely, even getting agreement between consumer and provider on what consumer.hostname even is can be… an adventure, and the ways that are typically easier to do are also more amenable to attacker influence.
  • The construction hash(k+consumer.hostname) would have to be carefully evaluated against possible attacks, which is a non-trivial exercise. There are extremely good reasons why HMAC(K, m) is defined as H((K' xor opad) || H((K' xor ipad) || m)), and not just H(K || m). Cryptography Is Hard.
4 Likes