5 ms·
So how many thousands of logins does the client have to do for this to binary search one key?
by iraqmtpizza 4y ago
So how many thousands of logins does the client have to do for this to binary search one key?
- Arnavion 4y agoBinary searching for an n-bit number based on a high-or-low oracle takes a max of n attempts.
- tptacek 4y agoIt takes about 512 logins, because after you've leaked a certain number of RSA key bits, you can set up a lattice search for the remaining bits. Because of the way the authentication and key escrow system worked, Mega could have run this attack over long periods of time, in parallel for all its users; the attack doesn't have to occur within a bounded period of time the way, say, an ephemeral-static ECDH TLS attack would work.
- im3w1l 4y agoMaybe I misunderstand, but wouldn't the attack be visible to the user when the encryption glitches out and they have to reattempt the login or something?
- tptacek 4y agoNo! That's another amazing detail here. The attacker is the server, and so it can just pretend you logged in successfully. You won't have fetched your key properly, but the Mega client automatically re-fetches the key when that happens.
- im3w1l 4y ago> You won't have fetched your key properly, but the Mega client automatically re-fetches the key when that happens. Is that something it could hypothetically do, or something that the current code does? In the latter case, is there any legitimate reason for doing that? And this would be detectable right, maybe not by a casual observer, but by a security researcher?
- tptacek 4y agoHow would you know? The whole point of the cryptosystem is you can't assume what the server code is doing.
- im3w1l 4y agoWell you said the client refetches the key, so that sounds like a network request you could observe.
- tptacek 4y agoSure; you could also look for all-zero SIDs. That relies on you knowing about this attack a priori, and if you know about it you can just not have the vulnerability.
- im3w1l 4y agoYeah, I was just trying to evaluate the risk that >Mega could have run this attack over long periods of time, in parallel for all its users; without anybody catching on. In light of our discussion, I don't think it's too likely.
- tptacek 4y agoNo, I don't agree at all. There is literally new science in this paper; the idea that random "security researchers" looking at benign-looking crypto code and monitoring all the connections their clients made (a thing nobody does) would ever have caught this is not plausible.
- im3w1l 4y agoActually I have a second question about this point.. Does this mean it would allow the user in even if the password is mistyped?
- tptacek 4y agoNo, if you mistype the password then the server can't look up your escrowed RSA key (it's looked up with an "authentication key" derived from PBKDF2).