oss-security - Re: Fixing the XML signature HMAC truncation authentication bypass

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 15 Jul 2009 02:51:46 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Florian Weimer <fw@...eb.enyo.de>
Subject: Re: Fixing the XML signature HMAC truncation authentication bypass

On Wednesday 15 July 2009, Robert Buchholz wrote:
> 1) Apache
> Bug:
> https://issues.apache.org/bugzilla/show_bug.cgi?id=47526
> Patch:
> http://svn.apache.org/viewvc?view=rev&revision=794013
>
> It seems they disallow HMAC truncation completely.
> * In my personal opinion the best move (since we're dealing with XML,
>   who cares about an additional <16 bytes?)

This was Java only, the C++ variant has this fix:
http://svn.apache.org/viewvc?view=rev&revision=794017

which is 80/half.


Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.