Comment 19 for bug 1490804
Revision history for this message
| Dolph Mathews (dolph) wrote Re: PKI Token Revocation Bypass | #19 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
0e1f616
(Get the code!)
The attached test manipulates UUID, PKI, PKIz, and Fernet tokens by incrementing and decrementing individual bytes, as illustrated in the bug description. This test passes against each token type, showing that the manipulated tokens cannot be validated *online* against keystone. To be clear, this patch does not contain a fix, nor does it confirm or invalidate the bug report.
Unless I missed something, that means the scope of this bug is limited to validating tokens offline (against the token revocation list in keystonemiddlew