From: Nick Mathewson <nickm@torproject.org>
Date: Mon, 26 Mar 2012 18:06:27 +0000 (-0400)
Subject: Safe cookie authentication gets a changes file
X-Git-Tag: tor-0.2.3.13-alpha~2^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9740f067c4bed47beb63483be4f4636167a04019;p=thirdparty%2Ftor.git

Safe cookie authentication gets a changes file
---

diff --git a/changes/safecookie b/changes/safecookie
new file mode 100644
index 0000000000..fd7d7af2b0
--- /dev/null
+++ b/changes/safecookie
@@ -0,0 +1,9 @@
+  o Security Features:
+    - Provide controllers with a safer way to implement the cookie
+      authentication mechanism. With the old method, if another locally
+      running program could convince a controller that it was the Tor
+      process, then that program could trick the contoller into
+      telling it the contents of an arbitrary 32-byte file. The new
+      "SAFECOOKIE" authentication method uses a challenge-response
+      approach to prevent this. Fixes bug 5185, implements proposal 193. 
+