Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

valid delayedKeys might be rejected #238

Open
ineiti opened this issue Sep 3, 2020 · 0 comments
Open

valid delayedKeys might be rejected #238

ineiti opened this issue Sep 3, 2020 · 0 comments
Labels
bug Something isn't working

Comments

@ineiti
Copy link
Collaborator

ineiti commented Sep 3, 2020

Probably not important anymore, as delayed keys will get more and more rare with the new GAEN versions. But the following can happen with very unfortunate clock synchronisation:

  1. Day 1: User sends keys to exposed with a delayedKeyDate from day 0, which is accepted by ValidationUtils.validateDelayedKeyDate, and a JWT token created
  2. Day 2: User sends last key to exposednextday with the key from day 0, which matches the JWT claim created by exposed, but which will be rejected by ValidationUtils.vlidateDelayedKeyDate
@ineiti ineiti added the bug Something isn't working label Sep 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant