5 ms·
Everything that could go wrong has gone wrong. ECB mode AES? Check. No authentication on encrypted data? Check. RSA without blinding? Check. Bad random numb
by tyho 12y ago
Everything that could go wrong has gone wrong.
ECB mode AES? Check.
No authentication on encrypted data? Check.
RSA without blinding? Check.
Bad random number source? Check Check Check.
- userbinator 12y agoECB mode I think this is the worst part, as anyone who has even the slightest bit of knowledge about how to use block ciphers (even if it's just reading Wikipedia articles - http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29 http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... ) would know ECB is seriously weak.
- lunixbochs 12y agoI believe the random number generation failures are much worse. ECB allows detection of duplicate blocks and block shuffling/copy-paste, while poor random number generation allows you to blindly recover entire keys and use them to decrypt or encrypt whatever you want.
- stouset 12y agoECB with chosen-plaintext also allows you to decrypt whatever you want.
- tedunangst 12y agoDetails?
- tptacek 12y agoIt's one of our crypto challenges, and the conceptual basis for the BEAST attack.
- tedunangst 12y agoI believe I read a little too much into "decrypt anything."
- tptacek 12y agoWhat were you thinking they meant? (Just curious.)
- tedunangst 12y agoGuess and check (beast, as I understand it) requires some prior knowledge of the data format. I was imagining something that worked against entirely random data.
- tptacek 12y agoYes. You can do simple things to data to make the basic byte-at-a-time attack hard to conduct. But a comparable amount of effort takes you to strong authenticated encryption. Virtually all systems that use ECB and have attacker-influenced plaintext are susceptible to the attack we're talking about.
- pbsd 12y agoNot exactly chosen-plaintext; pedantically speaking it's blockwise-adaptive chosen plaintext. The distinction is important because provable resistance to regular chosen plaintext attacks (i.e., IND-CPA) is part of what kept broken modes around for so long---they're 'provably secure'!
- tptacek 12y agoBeing able to detect duplicate blocks is usually game-over for an encrypted transport. ECB is fatally broken in real applications.
- digi_owl 12y agoWould that be the "broken by design" mode that NSA snuck in there?
- tedunangst 12y agoNo. ECB mode is simply how ciphers work. It's the black box that every better mode is built on.
- tptacek 12y agoSet aside "RSA without blinding"; this is RSA without padding. I lost patience trying to find where they're using Diffie-Hellman but you can bet that they're not checking parameters well, too.
- sschueller 12y agoInstead of all these crypto expert complaining about how bad it is why doesn't any of them fix it and make a pull request or fork the project if it is at such a dismal state? Maybe the reason so many coders are bad at crypto is because the crypto community is mostly spooks and the rest are unwilling take the time to explain and teach what they know. Instead they spend hours writing and analyzing other peoples work just so they can gloat on how bad it is.