Hacker News Reader

cryptbeon CloudFlare's Heartbleed challenge cracked

Yeah, you're correct. So it seems that you don't need math to solve this challenge, but maybe luck and patience.

cryptbeon CloudFlare's Heartbleed challenge cracked

I wrote a tool some time ago. It's 10 lines of Python using pyasn1.

cryptbeon CloudFlare's Heartbleed challenge cracked

You don't need to use p or q. See http://vnhacker.blogspot.com/2014/04/idea-to-solve-cloudflar...

I don't know why the authors didn't make a website for the SCISSOR attack (a.k.a the cookie cutter attack in the paper), which is way more practical and (imho) much cooler than this session resumption thing.

The idea of that attack is similar to what we did in CRIME, but applies to HTTP responses. Basically you inject enough data to split the response into two records and drop the second one. Some browsers would happily accept the truncated response, and change their state. As a result you could remove the Secure flag on the Set-Cookie header, and steal the cookies if the server or the client doesn't support HSTS.

cryptbeon Trevor Perrin requests removal of NSA from IETF Crypto Review

My take on PAKE: it's a way to establish a shared key (KE), authenticating each other with a password (PA). The shared key could then be used to build a secure channel.

Believe it or not, I've seen many people thinking that KE alone is enough to build a secure channel. This misconception is probably as widespread as encryption provides message integrity. One needs to know he's talking to the right person, otherwise he's vulnerable to some man in the middle.

There are many ways to solve this authentication problem. A large number of TLS ciphersuites uses PKI, but there are also ciphersuites using pre-shared key or password such as TLS-PSK or TLS-SRP. PAKE protocols use a password to authenticate each other, e.g., if only Bob could know the password he's the only one could finish the protocol with Alice.

Recently I've worked on some authenticated key exchange problems not using a password, which could be fun to think about:

1) How to build a secure inter-app channel on iOS.

2) How to bootstrap keyboard-less devices to password-protected WIFI network.

cryptbeon Trevor Perrin requests removal of NSA from IETF Crypto Review

tlslite is very neat. it must be super hard for me to work on tls without it.

> virtually every modern TLS break came from ideas that Perrin popularized

oh i didn't know this. what are the ideas?

cryptbeon Google Security Team Member on NSA: "Fuck These Guys"

Thanks.

> And of course, there are VPN tunnels between data centers in addition to the above.

Could you please be more specific on the VPN solution that you are using? How do you manage the shared keys? How do you make sure 'system administrators can't easily read the traffic?"

cryptbeon Google Security Team Member on NSA: "Fuck These Guys"

could you share which technology are you using to encrypt all the traffic?

cryptbeon Why secure systems require random numbers

Two reasons why crypto needs randomness:

1) You need to generate keys that nobody can guess.

2) Much of modern crypto is built based on probabilistic encryption [1].

[1] http://theory.lcs.mit.edu/~cis/pubs/shafi/1984-jcss.pdf

cryptbeon Object injection vulnerability enables remote code execution in WordPress 3.6

Cool research. I like how you "connect-the-dots" from the benign-looking MySQL's behaviour to the bad code in Wordpress. This reminds me of http://www.suspekt.org/2008/08/18/mysql-and-sql-column-trunc....

I'm surprised that the fix in Wordpress wasn't explicitly marking fields that need to be serialized/unserialized, instead of second-guessing based on the broken promise by MySQL.

> MySQL replaces characters it doesn’t recognize (for the given character set), with a placeholder. MySQL will sometimes replace byte sequences with “?” or “�” (U+FFFD). Such replacements would not be harmful.

This is so wrong. A database must never change any data that it's asked to stored. Wordpress, and other applications, always make that assumption, and when it isn't true anymore all hell breaks loose.

PS: it blows my mind that it looks like strpos in PHP could return either boolean or integer [1].

[1] http://core.trac.wordpress.org/browser/tags/3.6.1/wp-include...

cryptbeon Why you should not trust emails sent from Google

I didn't say that I trust mail clients. I said mail clients shouldn't accept arbitrary HTML markups and tags in emails. That's a serious problem that needed to be addressed, regardless of Google Scholar being exploited to send emails with arbitrary links or not.

cryptbeon Why you should not trust emails sent from Google

Wow. Give me a break, please. What the OP reported was a super minor issue, and he's already got what he deserves.

His bug allowed him to inject links into verification emails sent by Google Scholar. He claimed that he could inject CSS links too, but that didn't make this problem any worse. Why? Because it's up to mail clients to load the linked CSS stylesheets or not. Gmail, for example, would never load those remote CSS files. If your webmail client does that, it's time to switch to a better one.

So he could inject links, which is annoying, but still a very minor issue. It may make phishing a bit easier, but you know what phishing has always worked against average Joe if you try hard enough. That means that this problem doesn't really give an attacker any advantages that he couldn't do by himself.

Disclaimer: I'm a member of the team that handles VRP.

cryptbeon Speculation on "BULLRUN"

> But here, we're talking about IPSEC, not HTTPS/TLS, and the fundamental cryptographic design weakness we're talking about is, I think, Bard's. I could be wrong, though.

No, it wasn't Bard's. It's Rogaway and Dei's.

cryptbeon Proposal to Change the Default TLS Ciphersuites Offered by Browsers

No, I didn't say that everyone generates their own curves. I meant the security community should generate our own curves. Somebody should email Thomas Pornin.

cryptbeon Proposal to Change the Default TLS Ciphersuites Offered by Browsers

So maybe we should generate our own curves. I propose something as follows:

1. Locate a public string. A tweet or a quote should suffice.

2. SHA-512 the string to obtain a seed.

3. Use that seed to generate b, and calculate N = #E(Fp) = n * h, and choose a base point P. Of course we need to ensure that these parameters are safe against known attacks.

4. Mandate that the new set of parameters MUST be supported wherever NIST prime curves are supported.

The last step is probably the most difficult. You don't need that if you don't need to interoperate with other implementations though.

cryptbeon Speculation on "BULLRUN"

> He is right about how specific the circumstances are that give rise to Bard's CBC IV attack. Not only that, but BEAST itself was the product of a former NSA cryptologist, now a Wisconsin university math professor; it is vanishingly unlikely that it was common knowledge inside of NSA, since the guy PUBLISHED it just a year or two after leaving the agency.

I don't think BEAST was a product of Bard. If we read Bard's papers then we probably never came up with BEAST [1]. Bard wanted to apply Rogaway-Dai's attack to SSL, but he didn't understand how browsers worked. His papers didn't target cookies - in fact he didn't even mention that word - but he wanted to decrypt short PIN sent in POST requests, which is impossible as far as I can tell. The reason we cited Bard was because his English is much better than us, so we'd thought that we could re-use his explanation of Rogaway-Dai's attack in the context of SSL. In other words, we both attempted to exploit the same vulnerability, but we used different approaches and targeted different secrets.

Another way to look at this: imagine if one reads Bard's do you think if he or she could use any of Bard's ideas to invent new BEASTies attacks, e.g., CRIME, Lucky 13, the RC4 attack, <your attack here>?

cryptbeon New attack plucks secrets from HTTPS-protected pages

Disclaimer: CRIME co-author.

It's the same attack. CRIME works for TLS compression, SPDY header compression (yes it broke HTTP/2.0 even before it's called HTTP/2.0), and HTTP gzip response. BREACH was described in slide 39 in our presentation. We didn't test it because it's an application-dependent attack, and we couldn't find a nice target. We're happy that BREACH authors have found a very good target, and proved that the attack works.

See: https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZ...

cryptbeon Creating and Verifying Hashes in PHP 5.5

If the password hashing APIs asks developers to generate a salt on their own it's neither easy nor safe.

I've worked on password hashing recently, and I think the best interfaces should take only a password, and return a hash. Modern password hashing algorithms, e.g., bcrypt, scrypt, etc., usually also need a set of local parameters. The API should hide them as well, and expose only a set of interfaces with safe and sound preconfigured parameters, which in turn determine how much CPU time and memory space will be used. One disadvantage of this approach is that it exposes the local parameters, hence make it a little bit easier for attackers.

This is exactly how crypto primitives have been designed. If the designers of AES ever let people choose the key size, sooner or later some people would shoot themselves in the foot, and set the key size to 1-bit. If you think this is an extreme example, it actually has happened, not in some obscure API that nobody uses, but in the very XMLDsig standard published by W3C [1].

Regarding password hashing standards, I found many misuses of libscrypt that would make it extremely easy to recover passwords. But I'll save the details for another blog post or something.

[1] http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu....

cryptbeon The Banality of ‘Don’t Be Evil’

> I've read the quote several times and while it does say that things generally aren't private online it also clearly suggests that you shouldn't be doing things that you don't want other people to find out about which itself suggests that anyone wanting privacy is doing "bad" things.

I found it's surprising that you interpret the quote this way. Here's my interpretation: privacy on the Internet is an illusion.

cryptbeon Three years attacking web crypto

Hacker News community seem to be interested in crypto, so I guess you guys will enjoy this presentation, which is a summary of web crypto vulnerabilities discovered by Juliano Rizzo and me.

cryptbeon You are dangerously bad at cryptography

Glad that you like Dan Boneh's crypto class. I made the programming exercises :-).

cryptbeon Computer Science in Vietnam

I walked into a high school CS class, again without any advance notice. The class was working on the assignment below (partially translated by their teacher for my benefit afterwards). Given a data file describing a maze with diagonal walls, count the number of enclosed areas, and measure the size of the largest one.

What the OP was seeing is probably a special class in a high school for gifted students. Since winning national and international student competition is kind of a big deal in Vietnam, most major cities and provinces have such a school, but it's not easy to apply to them. All schools require applicants to take some tough and competitive entrance test that may have math problems harder than those in SAT or even GRE. As a result, the students who get in are usually the best of their ages, and they will be trained rigorously and restlessly for three years with the sole goal of winning a major programming contest such as IOI. That means they are the exception, not the norm. Most high school and even university students in the country can't tell what a loop is, let alone solving algorithmic problems.

cryptbeon Why the Fuck?

You use too many ",", and they make your writing hard to understand. Use shorter sentences, and consider replacing "," with a full stop.

cryptbeon HTTP 2.0 Draft – SPDY Protocol

I'm so surprised that the security consideration section has no reference to CRIME [1], which has made Google and Mozilla to turn off SPDY's header compression in Chrome and Firefox.

[1] https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZ...

cryptbeon Using the HTML5 Fullscreen API for Phishing Attacks

Pretty nice demo. The fullscreen notification can be fake with either bankofarnerica.com or http://en.wikipedia.org/wiki/IDN_homograph_attack.

cryptbeon Google disables compression for OpenSSL in Chrome - SSL exploit coming?

Problem 1 in Stanford's crypto class [1]:

Data compression is often used in data storage or transmission. Suppose you want to use data compression in conjunction with encryption. Does it make more sense to

A. Compress the data and then encrypt the result, or

B. Encrypt the data and then compress the result.

Now we know the correct answer is Neither.

[1] http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/hw1.pdf

cryptbeon Google disables compression for OpenSSL in Chrome - SSL exploit coming?

> Hollywood "guess the password one character at a time" animations

Did you see the BEAST attack? Exactly one byte at a time: http://www.youtube.com/watch?v=BTqAIDVUvrU

cryptbeon Blizzard Network Breached; Change Your Battle.Net Passwords

It seems like you either didn't actually read the RFC or read but didn't understand, then made a fuss out of your ignorance.

SRP uses SHA1, but not just that. Here is the relevant part of the RFC [1]:

The host stores user passwords as triplets of the form

        { <username>, <password verifier>, <salt> }

   Password entries are generated as follows:

        <salt> = random()
        x = SHA(<salt> | SHA(<username> | ":" | <raw password>))
        <password verifier> = v = g^x % N*

[1] http://www.ietf.org/rfc/rfc2945.txt

cryptbe on X86's Days as a Consumer Microarchitecture are Numbered

I'm surprised that nobody's mentioned that X86 and ARM are instruction set architectures, not microarchitectures.