6 ms·

I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aim

I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aimed at more of a general, less-technical audience. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... At the very least, they are validating TLS certificates. (Which I know is the true bare minimum requirement of TLS, but "goto fail" and all...) >We set up mitmproxy to intercept the TLS traffic and configured the Zoom Linux client to route its TLS traffic through mitmproxy. Fortunately, the Zoom client did appear to warn us that the fake TLS certificates generated by mitmproxy were untrusted.

fulafel 7y ago
The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.
- auiya 7y ago
  An explanation w/ visuals for how/why ECB is a broken mode of operation for cryptography - https://www.crypteron.com/blog/practical-searchable-encryption-and-security/ https://www.crypteron.com/blog/practical-searchable-encrypti...
  - prophesi 7y ago
    The exact same explanation + visual are already in The Intercept's article (and CitizenLab's). The rest of it is flaunting Crypteron's searchable encryption.
- cvwright 7y ago
  Is ECB any worse than any other deterministic encryption? Deterministic encryption can be ok if the data that you’re encrypting is already really random (high min-entropy). Compressed audio and video streams have a decent amount of entropy. Probably not enough to satisfy a cryptographer, but it’s probably enough to make it very difficult to learn much from 128-bit AES ECB blocks. Note that everyone’s favorite ECB example with the picture of Tux the Linux penguin is not very realistic, because the plaintext is not compressed. If you ECB a JPEG or a PNG, you won’t see the same patterns. I teach the attacks on ECB in my network security class. It’s bad, but AES is not the Caesar cipher. I’m not sure “trivially broken” is quite right. That said, I am really curious what Zoom is actually doing here. Going to have to take a look today. My guess is that the real fail from using ECB mode is more likely to come from using it on audio/video metadata, or on other more structured parts of the protocol.
  - prophesi 7y ago
    > Is ECB any worse than any other deterministic encryption? Yes, it's objectively worse than literally any other AES mode. You wouldn't need to depend on compression to protect your data.
    - cvwright 7y ago
      Note that I was asking specifically about deterministic modes. Those include SIV mode [1] but not the more common CBC, CTR, etc. Any deterministic encryption relies on entropy of the plaintext for security [2]. This is not unique to ECB. My objection was to the hyperbolic phrase "trivially broken." SIV mode is deterministic, but nobody who understands what it does would call it "trivially broken." And I'm definitely not saying that anyone should use ECB. Just that in this case, the vulnerability may not live up to the hype. By all means, go ahead bashing on Zoom. It's the cool thing to do these days, and clearly they've done enough to deserve most of it. [1] https://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf https://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf [2] https://eprint.iacr.org/2006/186 https://eprint.iacr.org/2006/186
      - deleted 7y ago
        [deleted]
      - prophesi 7y ago
        I'm personally more upset that they're advertising 256bit AES yet using 128bit AES. Sure, 128bit is still fine to use today, but it's still false advertising. They're already falsely claiming end-to-end encryption. It doesn't help that they're using the weakest mode of AES on top of all of this. If Zoom had a security audit, the auditors would quickly suggest using either some sort of ECB-based algorithm that uses an SIV, or just AES-CTR. I'm guessing they went with ECB due to its parallelization of the encryption/decryption process, which totally makes sense, except that there are much more secure algorithms out there.
        cvwright 7y ago
        Yeah you have to wonder: Did they just not know about counter mode? The implications of that are frightening.
- meowface 7y ago
  If you scroll down, they go into more detail, with the classic Linux penguin example.
dang 7y ago
That article is now being discussed at https://news.ycombinator.com/item?id=22768494 https://news.ycombinator.com/item?id=22768494. Not sure whether to try to merge these threads.

fulafel 7y ago

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

auiya 7y ago
An explanation w/ visuals for how/why ECB is a broken mode of operation for cryptography - https://www.crypteron.com/blog/practical-searchable-encryption-and-security/ https://www.crypteron.com/blog/practical-searchable-encrypti...
- prophesi 7y ago
  The exact same explanation + visual are already in The Intercept's article (and CitizenLab's). The rest of it is flaunting Crypteron's searchable encryption.
cvwright 7y ago
Is ECB any worse than any other deterministic encryption? Deterministic encryption can be ok if the data that you’re encrypting is already really random (high min-entropy). Compressed audio and video streams have a decent amount of entropy. Probably not enough to satisfy a cryptographer, but it’s probably enough to make it very difficult to learn much from 128-bit AES ECB blocks. Note that everyone’s favorite ECB example with the picture of Tux the Linux penguin is not very realistic, because the plaintext is not compressed. If you ECB a JPEG or a PNG, you won’t see the same patterns. I teach the attacks on ECB in my network security class. It’s bad, but AES is not the Caesar cipher. I’m not sure “trivially broken” is quite right. That said, I am really curious what Zoom is actually doing here. Going to have to take a look today. My guess is that the real fail from using ECB mode is more likely to come from using it on audio/video metadata, or on other more structured parts of the protocol.
- prophesi 7y ago
  > Is ECB any worse than any other deterministic encryption? Yes, it's objectively worse than literally any other AES mode. You wouldn't need to depend on compression to protect your data.
  - cvwright 7y ago
    Note that I was asking specifically about deterministic modes. Those include SIV mode [1] but not the more common CBC, CTR, etc. Any deterministic encryption relies on entropy of the plaintext for security [2]. This is not unique to ECB. My objection was to the hyperbolic phrase "trivially broken." SIV mode is deterministic, but nobody who understands what it does would call it "trivially broken." And I'm definitely not saying that anyone should use ECB. Just that in this case, the vulnerability may not live up to the hype. By all means, go ahead bashing on Zoom. It's the cool thing to do these days, and clearly they've done enough to deserve most of it. [1] https://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf https://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf [2] https://eprint.iacr.org/2006/186 https://eprint.iacr.org/2006/186
    - deleted 7y ago
      [deleted]
    - prophesi 7y ago
      I'm personally more upset that they're advertising 256bit AES yet using 128bit AES. Sure, 128bit is still fine to use today, but it's still false advertising. They're already falsely claiming end-to-end encryption. It doesn't help that they're using the weakest mode of AES on top of all of this. If Zoom had a security audit, the auditors would quickly suggest using either some sort of ECB-based algorithm that uses an SIV, or just AES-CTR. I'm guessing they went with ECB due to its parallelization of the encryption/decryption process, which totally makes sense, except that there are much more secure algorithms out there.
      - cvwright 7y ago
        Yeah you have to wonder: Did they just not know about counter mode? The implications of that are frightening.
meowface 7y ago
If you scroll down, they go into more detail, with the classic Linux penguin example.

dang 7y ago

That article is now being discussed at https://news.ycombinator.com/item?id=22768494 https://news.ycombinator.com/item?id=22768494. Not sure whether to try to merge these threads.