Evaluation of Cryptographically Secure Pseudo-Random Generated CRSF Encrypted Synchronizer Token Patterns

Source abstract

Cross-Site Request Forgery (CSRF) attacks pose a significant security threat by exploiting trust in authenticated user sessions, allowing unauthorized actions to be performed on behalf of users without their consent. In this work, we proposed a high entropy encrypted Synchronizer Token Pattern (eSTP), which uses server-generated and encrypted, session-specific, unique, highly unpredictable token tied to the user's session to validate requests. To be secure against bruteforce attacks, tokens need to have sufficient randomness. We simulated the process of generation, encryption and decryption of the CSRF tokens and evaluated the performance of the system by its security and cryptographic strength of the CSRF tokens by measuring the level of randomness and unpredictability (entropy) of the generated and encrypted tokens for different sizes of cryptographically secure pseudorandom number generators and session key lengths. Results show sufficient randomness for all the generated tokens with corresponding increase in entropy values for the encrypted tokens; an indication that encrypted tokens have sufficient length (entropy) to prevent brute-force attacks.