add_token script creates small token sizes #4481
Comments
|
Can you create a PR and link this issue to it? |
ericwb
added a commit
to ericwb/microk8s
that referenced
this issue
Apr 8, 2024
This fix bumps the token size from 16 to 32 bytes in order to match the default minimum entropy as recommended by Python docs. Note, that there is also a comparison to a constant TOKEN_ΜΙΝ_LEN where one module assumed that length to be characters and another module (utils.py) assumes that length to be bytes. So this fix uses bytes as the meaning from now on. Fixes canonical#4481 Signed-off-by: Eric Brown <[email protected]>
3 tasks
ericwb
added a commit
to ericwb/microk8s
that referenced
this issue
Apr 8, 2024
This fix bumps the token size from 16 to 32 bytes in order to match the default minimum entropy as recommended by Python docs. Note, that there is also a comparison to a constant TOKEN_ΜΙΝ_LEN where one module assumed that length to be characters and another module (utils.py) assumes that length to be bytes. So this fix uses bytes as the meaning from now on. Fixes canonical#4481 Signed-off-by: Eric Brown <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Summary
In the add_token script code here:
https://github.com/canonical/microk8s/blob/master/scripts/wrappers/add_token.py#L166
secrets.token_hexis used to create a token with a size of 16 bytes. Because it is hex, it does result in 32 characters, but this is less the recommended standard since 2015 of 32 bytes. The default entropy of this function is set to 32 bytes. Python's doc give further details on this:https://docs.python.org/3/library/secrets.html#how-many-bytes-should-tokens-use
What Should Happen Instead?
I recommend increasing the token size to 32 "bytes" instead of 32 characters.
Reproduction Steps
n/a
Introspection Report
n/a
Can you suggest a fix?
Yes, leave parameters empty so DEFAULT_ENTROPY of 32 will be used instead.
Are you interested in contributing with a fix?
yes
The text was updated successfully, but these errors were encountered: