Connect2id server 6.6.2 strengthens defences against timing attacks
The OpenID Connect server has now stronger defences in place against timing attacks on OAuth 2.0 client secrets (used in HTTP basic authentication) as well as the master API tokens used to integrate the IdP / AS server with other internal services.
Submitted client secrets are not just compared in constant time manner (to the extent that's possible with the Java runtime), but this comparison is now done using a (salted) SHA-256 hash of the secret. With such a three-layered defence (salt, hash, constant time string comparison) security shall be greatly enhanced.
The 6.6.2 release also updates a few of the underlying dependencies and fixes a bug related to Infinispan (with Redis and SQL as backends).
Download
To download a ZIP package of Connect2id server 6.6.2:
https://connect2id.com/assets/products/server/download/6.6.2/Connect2id-server.zip
(SHA-256: feb26baa5137f658ce7ca9cab20ae94a5ea2e0251af1c09cc23c27821a50225f)
As WAR package only:
https://connect2id.com/assets/products/server/download/6.6.2/c2id.war
(SHA-256: 4cec583dae1b2f4f2a2a49d43acc2e0067ba88d409eb48ebdd9d0e9d346a3c3f)
Questions?
Contact Connect2id support.
Release notes
6.6.2 (2017-04-26)
General
Switches to constant time comparison in the master web API token validation routines to guard against side-channel / timing attacks. The token values are salted and hashed with SHA-256 before comparison for additional protection.
Switches to constant time comparison in the client_secret validation routine to guard against side-channel / timing attacks. The client_secret values are hashed with SHA-256 before comparison for additional protection.
Configuration
/WEB-INF/jwkSet.json
- Checks the supplied elliptic curve (EC) keys on Connect2id server startup to ensure the public 'x' and 'y' parameters match the curve (P-256, P-384 or P-521).
Web API
- No changes
Bug fixes
- Fixes intermittent duplication of client objects when listing all clients via the client registration web API (HTTP GET) for Infinispan setups in invalidation mode with Redis as primary cache and an SQL database as persistence store (issue #273).
Dependencies
Upgrades to com.nimbusds:oauth2-oidc-sdk:5.26
Upgrades to com.nimbusds:nimbus-jose-jwt:4.37
Upgrades to com.nimbusds:oauth2-authz-store:5.14.2
Upgrades to com.nimbusds:common:2.5