Chapter 18. Identity in OpenStack Security Guide - havana

[Brant Knudson]

This chapter says "The Identity service could alternatively be configured to provide UUID tokens which are significantly shorter but may be less secure depending on your specific deployment model."

There's not meant to be any difference in security between using PKI versus UUID tokens. PKI tokens are supposed to save on network traffic and keystone server CPU (although I'm not sure that they do). Choosing PKI or UUID isn't a question of PKI is more secure. They're the same.

-----------------------------------
Built: 2013-11-21T20:48:44 00:00
git SHA: 216e166bd12b79d533be12c139aaef740a2ff7f1
URL: http://docs.openstack.org/security-guide/content/ch024_authentication.html
source File: file:/home/jenkins/workspace/openstack-security-guide/doc/security-guide/ch024_authentication.xml
xml:id: ch024_authentication

[Anne Gentle (annegentle)]

Requested that the Security Guide original authors triage this doc bug.

[Bryan D. Payne (bdpayne)]

I agree with Brant that the wording in the book here is misleading.

Brant, do you have a suggestion for improving the wording?

[Brian Schott (bfschott)]

Agree it is badly worded, but I think the argument here is that there are different versions of UUID where the tokens are less secure than a PKI generated authentication token. For example, Version 1 UUID is based on the mac address and timestamp of the server generating it, so someone external to the system can likely guess a valid authentication token on a busy system without intercepting any traffic at all. Not to mention that random is 122 bits and sha-1 is 128 bits. So, I'd argue that UUID is less secure than PKI not that PKI is token is completely secure.

[Brant Knudson (blk-u)]

Looking at the current Keystone code, UUID tokens are generated using uuid.uuid4() and not uuid1(). Same with all supported versions of Keystone (and Folsom, too).

I think this paragraph """

The Identity service could alternatively be configured to provide UUID tokens which are significantly shorter but may be less secure depending on your specific deployment model. Decisions about token implementation should take into consideration the level of trust needed within a given security domain.

"""

should be removed, since the token format is not relevant from a security perspective.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/63536

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.