4 ms·
I believe the random number generation failures are much worse. ECB allows detection of duplicate blocks and block shuffling/copy-paste, while poor random numbe
by lunixbochs 12y ago
I believe the random number generation failures are much worse. ECB allows detection of duplicate blocks and block shuffling/copy-paste, while poor random number generation allows you to blindly recover entire keys and use them to decrypt or encrypt whatever you want.
- stouset 12y agoECB with chosen-plaintext also allows you to decrypt whatever you want.
- tedunangst 12y agoDetails?
- tptacek 12y agoIt's one of our crypto challenges, and the conceptual basis for the BEAST attack.
- tedunangst 12y agoI believe I read a little too much into "decrypt anything."
- tptacek 12y agoWhat were you thinking they meant? (Just curious.)
- tedunangst 12y agoGuess and check (beast, as I understand it) requires some prior knowledge of the data format. I was imagining something that worked against entirely random data.
- tptacek 12y agoYes. You can do simple things to data to make the basic byte-at-a-time attack hard to conduct. But a comparable amount of effort takes you to strong authenticated encryption. Virtually all systems that use ECB and have attacker-influenced plaintext are susceptible to the attack we're talking about.
- pbsd 12y agoNot exactly chosen-plaintext; pedantically speaking it's blockwise-adaptive chosen plaintext. The distinction is important because provable resistance to regular chosen plaintext attacks (i.e., IND-CPA) is part of what kept broken modes around for so long---they're 'provably secure'!
- tptacek 12y agoBeing able to detect duplicate blocks is usually game-over for an encrypted transport. ECB is fatally broken in real applications.