4 ms·

Any attempt to change the IV (initialization vector) in a counter based block cipher mode entirely breaks decryption. So I am not sure why the "IND-CCA" attack

Any attempt to change the IV (initialization vector) in a counter based block cipher mode entirely breaks decryption. So I am not sure why the "IND-CCA" attack would need to be fixed. It is like claiming that a system is broken because an attacker can block message delivery.

martinralbrecht 4y ago
We explain how this works in Appendix A of https://nebuchadnezzar-megolm.github.io/static/paper.pdf https://nebuchadnezzar-megolm.github.io/static/paper.pdf but it's also a nice little exercise to work out how this breaks confidentiality. TL;DR: Yes, the plaintext coming out is not what you'd expect ("breaks decryption") but in a predictable way.
SAI_Peregrinus 4y ago
It only entirely breaks decryption if the ciphertext is authenticated. In something like bare CBC mode it only breaks the decryption of the next block, all later blocks are unaltered. Usually cryptographers consider anything less secure than IND-CCA3[1] Secure (authenticated INDistinguishability under adaptive Chosen Ciphertext Attack) to be "insecure" in the most general sense of security. The system must defend against forged messages, not simply keep the contents of messages confidential. Accepting forged messages almost always leads to some way to break confidentiality eventually. [1] https://crypto.stackexchange.com/a/26738/17861 https://crypto.stackexchange.com/a/26738/17861
- upofadown 4y ago
  I think you might mean IND-CCA2 here. IND-CCA3 doesn't seem to have gotten a lot of traction as a "notion". At any rate, once you have a deployed a system, theoretical notions of security are much less important. You then have to show an actual weakness if you want to convince someone to change something.
- tptacek 4y ago
  You're talking to an HN user with a hobbyhorse about authenticated encryption being, at least sometimes, a bad thing; they reached this opinion after being pressed on the weaknesses of PGP's authenticator. There's no actual debate here: the authors of the paper call the attack they're referring to out as a design flaw, but not an exploitable weakness. Presumably, the Matrix team will fix this as soon as it's tractable; I don't think any involved cryptography engineer is sticking up for the design.
  - upofadown 4y ago
    >You're talking to an HN user with a hobbyhorse about authenticated encryption being, at least sometimes, a bad thing... This is misleading as stated. >they reached this opinion after being pressed on the weaknesses of PGP's authenticator. This is just confusing to me. At any rate, the OpenPGP standard has a robust authenticated encryption construct in the form of the MDC (modification detection code) combined with OpenPGP's improved version of CFB (cipher feed back). Not that that has anything to do with the subject at hand. We are talking about Matrix.
    - tptacek 4y ago
      I mean, I guess I could back off the word "hobbyhorse" (I describe a bunch of my own interests that way, for what it's worth), but otherwise: I can support that argument with evidence, easily.

martinralbrecht 4y ago

We explain how this works in Appendix A of https://nebuchadnezzar-megolm.github.io/static/paper.pdf https://nebuchadnezzar-megolm.github.io/static/paper.pdf but it's also a nice little exercise to work out how this breaks confidentiality. TL;DR: Yes, the plaintext coming out is not what you'd expect ("breaks decryption") but in a predictable way.

SAI_Peregrinus 4y ago

It only entirely breaks decryption if the ciphertext is authenticated. In something like bare CBC mode it only breaks the decryption of the next block, all later blocks are unaltered. Usually cryptographers consider anything less secure than IND-CCA3[1] Secure (authenticated INDistinguishability under adaptive Chosen Ciphertext Attack) to be "insecure" in the most general sense of security. The system must defend against forged messages, not simply keep the contents of messages confidential. Accepting forged messages almost always leads to some way to break confidentiality eventually. [1] https://crypto.stackexchange.com/a/26738/17861 https://crypto.stackexchange.com/a/26738/17861

upofadown 4y ago
I think you might mean IND-CCA2 here. IND-CCA3 doesn't seem to have gotten a lot of traction as a "notion". At any rate, once you have a deployed a system, theoretical notions of security are much less important. You then have to show an actual weakness if you want to convince someone to change something.
tptacek 4y ago
You're talking to an HN user with a hobbyhorse about authenticated encryption being, at least sometimes, a bad thing; they reached this opinion after being pressed on the weaknesses of PGP's authenticator. There's no actual debate here: the authors of the paper call the attack they're referring to out as a design flaw, but not an exploitable weakness. Presumably, the Matrix team will fix this as soon as it's tractable; I don't think any involved cryptography engineer is sticking up for the design.
- upofadown 4y ago
  >You're talking to an HN user with a hobbyhorse about authenticated encryption being, at least sometimes, a bad thing... This is misleading as stated. >they reached this opinion after being pressed on the weaknesses of PGP's authenticator. This is just confusing to me. At any rate, the OpenPGP standard has a robust authenticated encryption construct in the form of the MDC (modification detection code) combined with OpenPGP's improved version of CFB (cipher feed back). Not that that has anything to do with the subject at hand. We are talking about Matrix.
  - tptacek 4y ago
    I mean, I guess I could back off the word "hobbyhorse" (I describe a bunch of my own interests that way, for what it's worth), but otherwise: I can support that argument with evidence, easily.