[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87pqhq362s.fsf@mid.deneb.enyo.de>
Date: Fri, 21 Oct 2011 14:03:07 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: PR attack against XML Encryption
* Yves-Alexis Perez:
> On jeu., 2011-10-20 at 12:58 +0200, Florian Weimer wrote:
>> A German university has released a press release, alleging a
>> vulnerability in the W3C XML Encryption standard. Apparently, error
>> reporting from existing implementations can be used as an oracle to
>> recover information from messages encrypted in CBC mode.
>>
>> Details have not been published, as far as I know. Does anybody know
>> more?
> but afaict the paper is not (yet?) available freely.
I took a brief look at the paper, and it's basically rehashing older
work on decryption error oracles. Full message recovery is apparently
possible, but leaves traces in the server log. It's the standard
which is at fault: encryption without authentication is just not safe
in general.
IBM has already changed error reporting in response to this issue:
<http://www-01.ibm.com/support/docview.wss?uid=swg1IC76651>
Of course, without an application-independent way to check the
integrity of the decrypted message (which would be provided by a
combiend encryption/authentication mode), this is only a partial
solution.
The authors also mention a second issue, where implementations confuse
signed and encrypted parts of a SOAP message, allowing attackers to
inject unsigned data which is presented as signed to the application.
This probably needs a separate fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
