[GODRIVER-2349] Prevent session ID reuse due to lower-than-expected system clock resolution Created: 18/Mar/22  Updated: 28/Oct/23  Resolved: 30/Mar/22

Status: Closed
Project: Go Driver
Component/s: None
Affects Version/s: 1.8.0, 1.8.4
Fix Version/s: 1.9.0, 1.8.5

Type: Bug Priority: Unknown
Reporter: Matt Dale Assignee: Matt Dale
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Related
related to GODRIVER-2361 Investigate using "x/exp/rand" or "go... Closed
is related to GODRIVER-2223 Use "math/rand" instead of "crypto/ra... Closed

 Description   

In various conditions, time.Now() returns a time with lower-than-expected resolution (500μs to 15ms). The Go driver uses time.Now() to seed some pseudo-random number generators, including the one for generating session IDs here. Due to that, it's possible to start two processes that reproduce the same sequence of session IDs if they are started at almost the same time.

Some known cases of low resolution clocks in Go:

  • On Windows with versions of Go before 1.16 (see here)

See the proposal for monotonic clocks in Go for more details about how Go measures time using both wall clocks and monotonic clocks.

For seeding all pseudo-random number generators in the Go driver, replace time.Now() with an int64 read from the "crypto/rand" random source.



 Comments   
Comment by Githook User [ 31/Mar/22 ]

Author:

{'name': 'Matt Dale', 'email': '9760375+matthewdale@users.noreply.github.com', 'username': 'matthewdale'}

Message: GODRIVER-2349 Seed all pseudorandom number generators with a crypto-secure random number. (#889)
Branch: release/1.8
https://github.com/mongodb/mongo-go-driver/commit/af8a5b1b41053f414f3cbf0cef6c0188b0b30c2d

Comment by Githook User [ 30/Mar/22 ]

Author:

{'name': 'Matt Dale', 'email': '9760375+matthewdale@users.noreply.github.com', 'username': 'matthewdale'}

Message: GODRIVER-2349 Seed all pseudorandom number generators with a crypto-secure random number. (#889)
Branch: master
https://github.com/mongodb/mongo-go-driver/commit/0cd9fa6de3b2c042f03453457a2272699ea75780

Comment by Matt Dale [ 25/Mar/22 ]

PR: https://github.com/mongodb/mongo-go-driver/pull/889

Generated at Thu Feb 08 08:38:22 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.