4 ms·
The problem here was that authentication could be stripped and substituted (digital signatures).
by Natanael_L 11y ago
The problem here was that authentication could be stripped and substituted (digital signatures).
- tptacek 11y agoDifferent sense of the word "authentication"! What you (and, no doubt, the Apple engineers) are thinking of as authentication is really a signature. Signatures and authenticators aren't the same thing. Here, we're referring to message authentication, which is the mechanism of using a secret key (usually agreed on at the same time as the secret key for the cipher itself) to apply a "secure checksum" to the ciphertext, to ensure it isn't tampered with. Trying to use a signature in lieu of an authenticator is what got Apple in trouble here. In addition to ECDSA signatures, those messages also should have used a MAC, or, better still, an encryption mode with a MAC built in, like OCB or EAX or NORX.
- sdevlin 11y agoIf messages come from one known-good source (e.g. firmware updates), a digital signature is a valid message authenticator. Where this falls down is in multi-user settings (e.g. iMessage), where secret-key authentication via MAC becomes a necessity. I'd still recommend always to use an authenticated cipher, since the above distinction can be very fine.