7 ms·

Hacking a CTF: Do not use ECB mode for encryption

42 points by znano 3y ago

demondemidi 3y ago
Guess OP never cracked a book on crypto. The aes penguin is like two decades old now. https://raw.githubusercontent.com/pakesson/diy-ecb-penguin/master/Tux_ecb.png https://raw.githubusercontent.com/pakesson/diy-ecb-penguin/m...
- anonym29 3y ago
  Do any specific books come to mind for you as recommended reading for those looking to learn more?
  - noam_k 3y ago
    I recommend going through the CryptoPals[0] challenges. I'm halfway and they really beat into you the problems with ECB. [0]https://cryptopals.com/ https://cryptopals.com/
  - tptacek 3y ago
    JP Aumasson's "Serious Cryptography" and David Wong's "Real World Cryptography" are good starts.
  - computerfriend 3y ago
    Cryptography Engineering is the classic. Serious Cryptography is also good and more recent.
    - tptacek 3y ago
      I liked Cryptography Engineering ("Practical Cryptography") but it definitely doesn't hold up; it was obsolete by 2010. You'd get yourself in trouble implementing from it today.
  - kccqzy 3y ago
    Serious Cryptography by Jean-Philippe Aumasson.
- coppsilgold 3y ago
  A block cipher in ECB mode is a substitution cipher, with all the weaknesses that entails. A substitution cipher with a lot of bits per symbol.
- tptacek 3y ago
  For over a decade, the Internet believed the problem with ECB was that you could see penguins through it. Implementors looked at that, said "I don't care if you can see penguins through this", and plowed ahead. In fact the real problems with ECB are that you can rewrite the plaintext and, in many common configurations, decrypt it outright --- the same insight got us the BEAST TLS attack.
coppsilgold 3y ago
There is an AES secure mode of operation that is almost on the level of ECB in terms of performance: OCB[1]. OpenSSL has support for it and all patents have expired. The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-256-GCM 655193.56k 1747223.44k 3399072.36k 4490100.61k 5033129.30k 5108596.96k AES-256-OCB 631357.15k 2268916.74k 4794610.30k 6492985.36k 7174274.14k 7301540.60k AES-256-ECB 997960.96k 3972424.35k 8096120.70k 8105542.89k 8179659.94k 8188882.64k [1] <https://en.wikipedia.org/wiki/OCB_mode https://en.wikipedia.org/wiki/OCB_mode>, <https://competitions.cr.yp.to/round3/ocbv11.pdf https://competitions.cr.yp.to/round3/ocbv11.pdf>
- tptacek 3y ago
  In the main, people don't use ECB for performance; they use it because it doesn't require any library support and it doesn't require you to understand what a "cipher mode" is --- it's just the cipher applied directly to the plaintext, which, if you don't have any cryptography domain knowledge, seems like a totally sane thing to do. I'm an advocate for calling ECB "the default mode".
  - Retr0id 3y ago
    Calling it the default mode sounds a bit risky, if one assumes that defaults are secure.
    - tptacek 3y ago
      The implication, of course, is that the defaults in cryptography are rarely secure.
      - Retr0id 3y ago
        That seems like something we should to try to fix, rather than lean into
dataflow 3y ago
I really don't understand why people don't just use a counter-based cipher. Like whichever one is the one where you start with a random IV, generate an infinite pseudorandom string from it, xor it with your data & its hash. Bonus points if you do this with multiple ciphers and xor them. Why is this not popular?
- minitech 3y ago
  > Why is this not popular? If you meant using a counter-based cipher: it is. GCM is the most popular mode on the modern internet, for example. If you meant using multiple ciphers: because it adds overhead without adding security.
  - SAI_Peregrinus 3y ago
    Of note: cascading ciphers is, in general, at most as secure as the first cipher. The rest add nothing. For additive stream ciphers (like CTR mode) it's as secure as the most secure cipher instead.
    - deleted 3y ago
      [deleted]
    - n2d4 3y ago
      I think you made a typo, "at most as secure" should be "at least as secure" :) But you're right, the important takeaway here is that encrypting with a weak and a strong cipher sequentially may be less secure than just using the strong cipher. For those to which this seems counterintuitive, here is the paper that shows this result: https://link.springer.com/article/10.1007/BF02620231 https://link.springer.com/article/10.1007/BF02620231
      - magicalhippo 3y ago
        Would be a fun plot twist in a Bond-like movie. Baddies have used multiple encryption algorithms like an onion, which due to this issue can be broken rather easily by the good guys. "Good thing they didn't know about this issue and put the weak cipher first..."

42 points by znano 3y ago

Guess OP never cracked a book on crypto. The aes penguin is like two decades old now. https://raw.githubusercontent.com/pakesson/diy-ecb-penguin/master/Tux_ecb.png https://raw.githubusercontent.com/pakesson/diy-ecb-penguin/m...

anonym29 3y ago
Do any specific books come to mind for you as recommended reading for those looking to learn more?
- noam_k 3y ago
  I recommend going through the CryptoPals[0] challenges. I'm halfway and they really beat into you the problems with ECB. [0]https://cryptopals.com/ https://cryptopals.com/
- tptacek 3y ago
  JP Aumasson's "Serious Cryptography" and David Wong's "Real World Cryptography" are good starts.
- computerfriend 3y ago
  Cryptography Engineering is the classic. Serious Cryptography is also good and more recent.
  - tptacek 3y ago
    I liked Cryptography Engineering ("Practical Cryptography") but it definitely doesn't hold up; it was obsolete by 2010. You'd get yourself in trouble implementing from it today.
- kccqzy 3y ago
  Serious Cryptography by Jean-Philippe Aumasson.
coppsilgold 3y ago
A block cipher in ECB mode is a substitution cipher, with all the weaknesses that entails. A substitution cipher with a lot of bits per symbol.
tptacek 3y ago
For over a decade, the Internet believed the problem with ECB was that you could see penguins through it. Implementors looked at that, said "I don't care if you can see penguins through this", and plowed ahead. In fact the real problems with ECB are that you can rewrite the plaintext and, in many common configurations, decrypt it outright --- the same insight got us the BEAST TLS attack.

coppsilgold 3y ago

There is an AES secure mode of operation that is almost on the level of ECB in terms of performance: OCB[1]. OpenSSL has support for it and all patents have expired. The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-256-GCM 655193.56k 1747223.44k 3399072.36k 4490100.61k 5033129.30k 5108596.96k AES-256-OCB 631357.15k 2268916.74k 4794610.30k 6492985.36k 7174274.14k 7301540.60k AES-256-ECB 997960.96k 3972424.35k 8096120.70k 8105542.89k 8179659.94k 8188882.64k [1] <https://en.wikipedia.org/wiki/OCB_mode https://en.wikipedia.org/wiki/OCB_mode>, <https://competitions.cr.yp.to/round3/ocbv11.pdf https://competitions.cr.yp.to/round3/ocbv11.pdf>

tptacek 3y ago
In the main, people don't use ECB for performance; they use it because it doesn't require any library support and it doesn't require you to understand what a "cipher mode" is --- it's just the cipher applied directly to the plaintext, which, if you don't have any cryptography domain knowledge, seems like a totally sane thing to do. I'm an advocate for calling ECB "the default mode".
- Retr0id 3y ago
  Calling it the default mode sounds a bit risky, if one assumes that defaults are secure.
  - tptacek 3y ago
    The implication, of course, is that the defaults in cryptography are rarely secure.
    - Retr0id 3y ago
      That seems like something we should to try to fix, rather than lean into

dataflow 3y ago

I really don't understand why people don't just use a counter-based cipher. Like whichever one is the one where you start with a random IV, generate an infinite pseudorandom string from it, xor it with your data & its hash. Bonus points if you do this with multiple ciphers and xor them. Why is this not popular?

minitech 3y ago
> Why is this not popular? If you meant using a counter-based cipher: it is. GCM is the most popular mode on the modern internet, for example. If you meant using multiple ciphers: because it adds overhead without adding security.
- SAI_Peregrinus 3y ago
  Of note: cascading ciphers is, in general, at most as secure as the first cipher. The rest add nothing. For additive stream ciphers (like CTR mode) it's as secure as the most secure cipher instead.
  - deleted 3y ago
    [deleted]
  - n2d4 3y ago
    I think you made a typo, "at most as secure" should be "at least as secure" :) But you're right, the important takeaway here is that encrypting with a weak and a strong cipher sequentially may be less secure than just using the strong cipher. For those to which this seems counterintuitive, here is the paper that shows this result: https://link.springer.com/article/10.1007/BF02620231 https://link.springer.com/article/10.1007/BF02620231
    - magicalhippo 3y ago
      Would be a fun plot twist in a Bond-like movie. Baddies have used multiple encryption algorithms like an onion, which due to this issue can be broken rather easily by the good guys. "Good thing they didn't know about this issue and put the weak cipher first..."