3 ms·
The developer who made this mistake probably didn't think s/he was writing crypto code. (Switching to "he" for brevity) He probably thought he was merely making
by brlewis 18y ago
The developer who made this mistake probably didn't think s/he was writing crypto code. (Switching to "he" for brevity) He probably thought he was merely making use of someone else's crypto code. The mistake was in choosing what string to sign, not in the function applied to that string after it was chosen. I think the real lesson here is that if your app needs cryptography, then you need at least a black-box understanding of what crypto does and doesn't do.
- tptacek 18y agoIn my experience, the people who do the worst at building secure systems are the ones who know "just enough" about how crypto works. These are the people who implement Diffie-Hellman and don't check parameters, the people who implement AES in ECB mode, the people who store passwords hashed with ultra-fast digest schemes, the ones that leak timing information or cipher state in distinguishable error messages, and the people who implement mirrorable challenge-response protocols. The "dumb" developers just use OpenSSL and PGP, and they usually come out ahead in the end. Also: I doubt the Amazon implementers here were dumb. I bet they were pretty smart. They just forgot about canonicalization; this is a classic problem in signature systems. Building crypto features is a good way to get screwed. (PS: I feel qualified to take a contract breaking systems like this, but probably not qualified enough to engineer my own crypto protocol.)