6 ms·

via matthew green recently: So per @justintroutman and now confirmed, Microsoft has substantially weakened its disk encryption in Windows 8. Now uses plain CBC

via matthew green recently: So per @justintroutman and now confirmed, Microsoft has substantially weakened its disk encryption in Windows 8. Now uses plain CBC mode.

xnull2guest 12y ago
Yup, the diffuser was removed years ago. The designer of the diffuser removed was Neils Ferguson, the cryptographer who called out DUAL_EC as a backdoor in 2004. The stated reason was FIPS compliance.
- tptacek 12y ago
  Do you understand what the "diffuser" in Bitlocker was intended to do? Virtually every other mainstream FDE scheme uses XTS, which is also not authenticated; XTS is literally the ECB mode of tweakable block ciphers.
  - xnull2guest 12y ago
    > Do you understand what the "diffuser" in Bitlocker was intended to do? Yes. > Virtually every other mainstream FDE scheme uses XTS, which is also not authenticated; XTS is literally the ECB mode of tweakable block ciphers. Not really relevant?
    - tptacek 12y ago
      If you think the point I made about XTS isn't really relevant, I'm going to timidly suggest that you don't actually understand Elephant. I apologize in advance for saying that, but I think it's more productive to be honest than tactful in this case.
      - xnull 12y ago
        AES CBC + Elephant != XTS Elephant 'mixes' the blocks on a sector level to limit CBC block modification attacks. It does not limit the maximum size to align to sectors. It is not XTS. Nor is my claim that Elephant is what you want or need. Merely that it was removed, that Ferguson designed it, and that FIPS compliance was the underlying justification.
        tptacek 12y ago
        I didn't say Elephant was XTS. I said that neither XTS --- the industry standard sector-level construction --- nor Elephant actually authenticated sectors. All three of AES-CBC, Elephant, and XTS fail to authenticate data. This isn't my point; it's Rogaway's, and the opinion of several other people during the XTS standardization process, including Ferguson. So it's a stretch to talk about how Microsoft "weakened" Bitlocker by removing the idiosyncratic Elephant construction. None of the design alternatives Microsoft had available provided real authentication, and all of them provide adequate confidentiality (to the extent that's possible with sector-level crypto, which is itself just a bad idea).
        xnull 12y ago
        Couldn't it both be true that Microsoft weakened Bitlocker by removing Elephant AND that AES-CBC + Elephant isn't good enough (e.g. lack of integrity)? We might discuss how to best design FDE, or whether FDE is what we want. But that conversation is orthogonal to the fact that AES-CBC is weaker than AES-CBC + Elephant, which is what we are talking about here. Your criticism comes down to: "CBC + Elephant may be stronger than CBC, but neither are strong enough for me". I agree with this.
        tptacek 12y ago
        Not quite. My high level response to this thread, which opened with a subtextual claim that Microsoft removed Elephant in yet another example of a big vendor being coerced by NSA into weakening end-user crypto, is twofold: * First, that Elephant does not provide meaningful (and certainly not provable) security improvements, and, put in the context of FDE in general, does not give/remove a Bitlocker capability that other mainstream FDE systems actually have. * Second, that the clunky feature Elephant tries to provide (Ferguson calls it "poor man's authentication") is in fact not at all relevant to the NSA threat model; to wit: if your adversary has an (a) continuous and (b) active vantage point to hit you from, no FDE solution can help you. FDE is exclusively valuable in the case where your disk is irrevocably and totally compromised, despite the folklore that says otherwise. Popping up a level further on the stack: I'm rebutting the claim that NSA coerced MSFT into removing Elephant. It was a marginal implementation of a marginal countermeasure that wasn't relevant to NSA. Popping up a level further on the stack: I do not believe that NSA has within the last decade coerced Microsoft into doing anything cryptographic.
tptacek 12y ago
What does CBC mode have to do with the security of Bitlocker? Do you think CBC mode is weak because of that god-awful Wikipedia article on full disk encryption? Because that article is god-awful.
- justcommenting 12y ago
  I've never used or studied BitLocker and don't have much relevant expertise when it comes to FDE...just was reading comments and was reminded of a tweet that seemed relevant. It would be really cool to hear what you think of using CBC mode for FDE, though.
  - tptacek 12y ago
    I think neither CBC mode nor XTS mode is a great tool for encrypting disks, but rather than restating all my thoughts, I'll just link back to what I wrote about it a few months ago: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ But, apropos this thread: the specific claim Wikipedia makes about the insecurity of CBC mode for FDE was debunked by Phil Rogaway, who --- much as I like Justin Troutman --- trumps Justin Troutman. :)
    - justcommenting 12y ago
      this was an excellent read--thank you i may have to do some wikipedia editing later today ;-)
    - justintroutman 12y ago
      I'm okay with being trumped by Phil; that's fair. :) I'm largely in agreement with you, and I enjoyed your article on XTS. My general thought towards Elephant's contribution to CBC is that it forced coarse-grained manipulation, which is probably a lot more likely to crash a system as opposed to allowing meaningful attacks. To risk a new design like Elephant implies that they found the attack model worth consideration; we know the rationale for including it, but we don't know the rationale for removing it. Perhaps knowing this would tell us something useful about current perceptions on disk encryption. Lastly, I echo your disdain for sector-level encryption.

via matthew green recently: So per @justintroutman and now confirmed, Microsoft has substantially weakened its disk encryption in Windows 8. Now uses plain CBC mode.

xnull2guest 12y ago

Yup, the diffuser was removed years ago. The designer of the diffuser removed was Neils Ferguson, the cryptographer who called out DUAL_EC as a backdoor in 2004. The stated reason was FIPS compliance.

tptacek 12y ago
Do you understand what the "diffuser" in Bitlocker was intended to do? Virtually every other mainstream FDE scheme uses XTS, which is also not authenticated; XTS is literally the ECB mode of tweakable block ciphers.
- xnull2guest 12y ago
  > Do you understand what the "diffuser" in Bitlocker was intended to do? Yes. > Virtually every other mainstream FDE scheme uses XTS, which is also not authenticated; XTS is literally the ECB mode of tweakable block ciphers. Not really relevant?
  - tptacek 12y ago
    If you think the point I made about XTS isn't really relevant, I'm going to timidly suggest that you don't actually understand Elephant. I apologize in advance for saying that, but I think it's more productive to be honest than tactful in this case.
    - xnull 12y ago
      AES CBC + Elephant != XTS Elephant 'mixes' the blocks on a sector level to limit CBC block modification attacks. It does not limit the maximum size to align to sectors. It is not XTS. Nor is my claim that Elephant is what you want or need. Merely that it was removed, that Ferguson designed it, and that FIPS compliance was the underlying justification.
      - tptacek 12y ago
        I didn't say Elephant was XTS. I said that neither XTS --- the industry standard sector-level construction --- nor Elephant actually authenticated sectors. All three of AES-CBC, Elephant, and XTS fail to authenticate data. This isn't my point; it's Rogaway's, and the opinion of several other people during the XTS standardization process, including Ferguson. So it's a stretch to talk about how Microsoft "weakened" Bitlocker by removing the idiosyncratic Elephant construction. None of the design alternatives Microsoft had available provided real authentication, and all of them provide adequate confidentiality (to the extent that's possible with sector-level crypto, which is itself just a bad idea).
        xnull 12y ago
        Couldn't it both be true that Microsoft weakened Bitlocker by removing Elephant AND that AES-CBC + Elephant isn't good enough (e.g. lack of integrity)? We might discuss how to best design FDE, or whether FDE is what we want. But that conversation is orthogonal to the fact that AES-CBC is weaker than AES-CBC + Elephant, which is what we are talking about here. Your criticism comes down to: "CBC + Elephant may be stronger than CBC, but neither are strong enough for me". I agree with this.
        tptacek 12y ago
        Not quite. My high level response to this thread, which opened with a subtextual claim that Microsoft removed Elephant in yet another example of a big vendor being coerced by NSA into weakening end-user crypto, is twofold: * First, that Elephant does not provide meaningful (and certainly not provable) security improvements, and, put in the context of FDE in general, does not give/remove a Bitlocker capability that other mainstream FDE systems actually have. * Second, that the clunky feature Elephant tries to provide (Ferguson calls it "poor man's authentication") is in fact not at all relevant to the NSA threat model; to wit: if your adversary has an (a) continuous and (b) active vantage point to hit you from, no FDE solution can help you. FDE is exclusively valuable in the case where your disk is irrevocably and totally compromised, despite the folklore that says otherwise. Popping up a level further on the stack: I'm rebutting the claim that NSA coerced MSFT into removing Elephant. It was a marginal implementation of a marginal countermeasure that wasn't relevant to NSA. Popping up a level further on the stack: I do not believe that NSA has within the last decade coerced Microsoft into doing anything cryptographic.

tptacek 12y ago

What does CBC mode have to do with the security of Bitlocker? Do you think CBC mode is weak because of that god-awful Wikipedia article on full disk encryption? Because that article is god-awful.

justcommenting 12y ago
I've never used or studied BitLocker and don't have much relevant expertise when it comes to FDE...just was reading comments and was reminded of a tweet that seemed relevant. It would be really cool to hear what you think of using CBC mode for FDE, though.
- tptacek 12y ago
  I think neither CBC mode nor XTS mode is a great tool for encrypting disks, but rather than restating all my thoughts, I'll just link back to what I wrote about it a few months ago: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ But, apropos this thread: the specific claim Wikipedia makes about the insecurity of CBC mode for FDE was debunked by Phil Rogaway, who --- much as I like Justin Troutman --- trumps Justin Troutman. :)
  - justcommenting 12y ago
    this was an excellent read--thank you i may have to do some wikipedia editing later today ;-)
  - justintroutman 12y ago
    I'm okay with being trumped by Phil; that's fair. :) I'm largely in agreement with you, and I enjoyed your article on XTS. My general thought towards Elephant's contribution to CBC is that it forced coarse-grained manipulation, which is probably a lot more likely to crash a system as opposed to allowing meaningful attacks. To risk a new design like Elephant implies that they found the attack model worth consideration; we know the rationale for including it, but we don't know the rationale for removing it. Perhaps knowing this would tell us something useful about current perceptions on disk encryption. Lastly, I echo your disdain for sector-level encryption.