WebApp Sec: Re: ColdFusion - CFID & CFTOKEN

[Rogan Dawes <lists () dawes za net>]

Jason binger wrote:

> I am currently doing some work with CF MX 6.1 and was
> wondering if anyone had some information on the
> strength of the CF cookie implementation.
>
> How random the token generation is? How is the
> generation performed?
> What is the range of the generated tokens? 
> Has an independent security analysis been performed
> and commented on in a public paper?
>
> I have not seen any vendor supplied information on
> this.
>
> Cheers,
> Jason
>
>  
Sample a number of userids with WebScarab, allow it to perform the 
calculations and graph it. Any non-randomness will show up immediately 
as a visual indicator.
Note, if the sessionid is something like MD5(time), the sessionid will 
appear random to external analysis, but someone with knowledge of the 
implementation would still be in a position to brute force session ids.
Regards,

Rogan