Hold Your Sessions: An Attack on Java Session-Id Generation

HTTP session-id’s take an important role in almost any web site today. This paper presents a cryptanalysis of Java Servlet 128-bit session-id’s and an efficient practical prediction algorithm. Using this attack an adversary may impersonate a legitimate client. Through the analysis we also present a novel, general space-time tradeoff for secure pseudo random number generator attacks.

• Type: Conference
• Year: 2005
• Where: CTRSA
• Authors: Zvi Gutterman, Dahlia Malkhi
• Keywords: Cryptology, CTRSA 2005, Practical Prediction Algorithm, Pseudo Random Number Generator, Servlet 128-bit Session-id