Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add_token script creates small token sizes #4481

Open
ericwb opened this issue Apr 4, 2024 · 1 comment · May be fixed by #4486
Open

add_token script creates small token sizes #4481

ericwb opened this issue Apr 4, 2024 · 1 comment · May be fixed by #4486

Comments

@ericwb
Copy link

ericwb commented Apr 4, 2024

Summary

In the add_token script code here:
https://github.com/canonical/microk8s/blob/master/scripts/wrappers/add_token.py#L166
secrets.token_hex is used to create a token with a size of 16 bytes. Because it is hex, it does result in 32 characters, but this is less the recommended standard since 2015 of 32 bytes. The default entropy of this function is set to 32 bytes. Python's doc give further details on this:
https://docs.python.org/3/library/secrets.html#how-many-bytes-should-tokens-use

What Should Happen Instead?

I recommend increasing the token size to 32 "bytes" instead of 32 characters.

Reproduction Steps

n/a

Introspection Report

n/a

Can you suggest a fix?

Yes, leave parameters empty so DEFAULT_ENTROPY of 32 will be used instead.

token = token_hex()

Are you interested in contributing with a fix?

yes
@codespearhead
Copy link

Can you create a PR and link this issue to it?

ericwb added a commit to ericwb/microk8s that referenced this issue Apr 8, 2024
@ericwb
Increase token size to 32 bytes
10746d2 
This fix bumps the token size from 16 to 32 bytes in order
to match the default minimum entropy as recommended by Python
docs.

Note, that there is also a comparison to a constant TOKEN_ΜΙΝ_LEN
where one module assumed that length to be characters and another
module (utils.py) assumes that length to be bytes. So this fix
uses bytes as the meaning from now on.

Fixes canonical#4481

Signed-off-by: Eric Brown <[email protected]>
@ericwb ericwb linked a pull request Apr 8, 2024 that will close this issue
Open
3 tasks
ericwb added a commit to ericwb/microk8s that referenced this issue Apr 8, 2024
@ericwb
Increase token size to 32 bytes
db26427 
This fix bumps the token size from 16 to 32 bytes in order
to match the default minimum entropy as recommended by Python
docs.

Note, that there is also a comparison to a constant TOKEN_ΜΙΝ_LEN
where one module assumed that length to be characters and another
module (utils.py) assumes that length to be bytes. So this fix
uses bytes as the meaning from now on.

Fixes canonical#4481

Signed-off-by: Eric Brown <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Increase token size to 32 bytes ericwb/microk8s
2 participants
@ericwb @codespearhead