3 ms·

> There is a class of crypto implementation bugs that arises from how you feed data to your MAC, so, if you're designing a new system from scratch, Google "cry

> There is a class of crypto implementation bugs that arises from how you feed data to your MAC, so, if you're designing a new system from scratch, Google "crypto canonicalization bugs". I get a whole bunch of links about javax.xml.crypto.dsig throwing exceptions, which wasn't terribly illuminating. I think the reference is to the bugs discussed on page 21 here: http://www.contextis.com/documents/33/Exploiting_XML_Digital_Signature_Implementations-HITBKL20131.pdf http://www.contextis.com/documents/33/Exploiting_XML_Digital... but I'm not sure.

agwa 11y ago
Here are some examples of HMAC canonicalization vulnerabilities: http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-insecure.html http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver... http://daeken.com/confusing-crypto-blobs http://daeken.com/confusing-crypto-blobs
TheLoneWolfling 11y ago
It boils down to this: Make sure the data fed to your MAC is unambiguous. Or rather, make sure the data fed to your MAC is done in such a way that you cannot have different messages appear the same to the MAC encoder. For instance, say you sort and concatenate your options without a delimiter. Then ["ab", "cd"] will have the same MAC as ["a", "bcd"], as in both cases the actual data fed to the MAC will be "abcd". This is a very bad thing.