Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

usenix.org

Post reply on HN
Print view View original

31–40 of 158 posts

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#31

Post by c00lio »

logifail wrote: post #20
londons_explore wrote: post #18

Earlier quoted context omitted.

> Emails don’t provide that legal value. In general, agreeing to something by text in an email is as legally enforceable as a signature.

> In general [..] ...but apparently not always. Not something I'd want to bet my business or reputation on. "AUSTRIA’s Federal Administrative Court [..] declared a framework contract from Austrian Federal Railways (ÖBB) to Stadler for the delivery of up to 186 double-deck trains to be null and void due to an alleged formal error in the qualified electronic signature of the offer." (September 2021) https://www.railjou…

That is about a public tender, where there are "form requirements", meaning that certain documents and signatures have to conform to the required form. Usually that means "in writing, on paper, with signatures made by hand" or the new legally accepted replacement of secure electronic signatures. Sometimes it might even mean signing the paper in front of a notary, e.g. for contracts regarding the sale of real estate. But in general, outside clearly defined exceptions, contracts and declarations do not have a form requirement, so even oral agreement or "conclusive behaviour" (sign language, point-and-grunt, silently carrying an item to the cash register) are absolutely valid.

Of course, when in doubt, proving the exact content of such an unwritten contract may be hard.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#32

Post by c00lio »

layer8 wrote: post #30
c00lio wrote: post #23

Earlier quoted context omitted.

EIDAS isn't worth the paper (pun intended) it is written on, if insecure "click a link in an email"-signature schemes such as https://help.eversign.com/hc/en-us/articles/6664408666013-Is... can claim compliance...

I don’t know where you’re taking “click a link in an email” from, but that’s decidedly not how eIDAS works. The private keys must be hardware-protected and under the sole control of an identified signer, which usually means either a physical token or a 2FA-protected remote key in an HSM. In addition, a prior ID verification procedure like video ID or a face-to-face verification is required.

Well. Eversign holds the key and promises to only use it when you authenticated by clicking the link in the email that was sent to you personally.

eIDAS was intentionally formulated to allow such signature services, making the whole thing quite pointless from a security perspective.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#33

Post by phrz »

tialaramex wrote: post #27
loeg wrote: post #17

Earlier quoted context omitted.

Sure, but do you have any indication cryptography is involved in this process? In my (limited) experience as a consumer, they just take some existing PDF and add marks on top of it.

Usually the distinction made is between electronic signature (e.g. you scrawled your mark on a piece of paper, scanned it and now the software lets you paste that image on signature pages) and digital signature (cryptographic)

The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#34

Post by jabroni_salad »

tialaramex wrote: post #28
munchler wrote: post #25

Does this affect the security of password-protected Office documents as well? I think there's lots of valuable information locked up with simple Excel or Word passwords.

I expect not, Office last century previously had a very simple password scheme (broken essentially instantly with modern tools) and then a poor one (take a couple seconds to break typical passwords) before I think settling on a more modern design where brute force isn't practical for a decent password. It's possible they threw that away to use this approach but seems unlikely

They are still using AES256 with 16 bytes of salt as far as I know.

It's good security but it's not like you can rate limit attempts or anything and password bruteforcing has gotten pretty good lately. You also have to wonder if there isn't a skeleton key of some kind hanging around, too.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#35

Post by [deleted] »

tpurves wrote: post #21
layer8 wrote: post #12

Earlier quoted context omitted.

At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS

I think the main point the parent comment is making is that, today and historically, the great majority of contract disputes today don't involve disputing (analog or digital) signatures. People usually dispute about all the other terms rather that about the act of having signed it. [Even though analog signatures aren't particularly secure either] However, if Microsoft signatures have now became more forgeable at scal…

[deleted]

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#36

Post by layer8 »

c00lio wrote: post #32
layer8 wrote: post #30

Earlier quoted context omitted.

I don’t know where you’re taking “click a link in an email” from, but that’s decidedly not how eIDAS works. The private keys must be hardware-protected and under the sole control of an identified signer, which usually means either a physical token or a 2FA-protected remote key in an HSM. In addition, a prior ID verification procedure like video ID or a face-to-face verification is required.

Well. Eversign holds the key and promises to only use it when you authenticated by clicking the link in the email that was sent to you personally. eIDAS was intentionally formulated to allow such signature services, making the whole thing quite pointless from a security perspective.

Service providers must undergo audits to ensure that the security measures they take meet the eIDAS requirements. This includes strong protective measures against unauthorized access to private keys. The keys are usually unrecoverable when the end user has lost their credentials. It’s actually quite involved and costly to become such an accredited provider.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#37

Post by ClarityJones »

tpurves wrote: post #21
layer8 wrote: post #12

Earlier quoted context omitted.

At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS

I think the main point the parent comment is making is that, today and historically, the great majority of contract disputes today don't involve disputing (analog or digital) signatures. People usually dispute about all the other terms rather that about the act of having signed it. [Even though analog signatures aren't particularly secure either] However, if Microsoft signatures have now became more forgeable at scal…

The question of signing generally arises with dueling forms, where there's no dispute that "a" 20-page contract was signed on June 4, 2017, and that this is page 20, with all of the signatures, but... What did that contract say in Paragraph G on Page 12?

Perhaps the bank only retained page 20, and is saying that they used the same master form for every mortgage and the master form says "this" on page 12.

Or one party discovers that other has misplaced their copy of the contract and then shows up with a copy that has advantageous wording on page 12.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#38

Post by MangoCoffee »

D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

when i was young i worked for a e-mortgage software company. our flagship software allows customer to sign online or on a electronic signing pad.

the whole legality is based on Electronic Records and Signatures in Commerce Act signed by Bill Clinton.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#39

Post by wongarsu »

ClarityJones wrote: post #37
tpurves wrote: post #21

Earlier quoted context omitted.

I think the main point the parent comment is making is that, today and historically, the great majority of contract disputes today don't involve disputing (analog or digital) signatures. People usually dispute about all the other terms rather that about the act of having signed it. [Even though analog signatures aren't particularly secure either] However, if Microsoft signatures have now became more forgeable at scal…

The question of signing generally arises with dueling forms, where there's no dispute that "a" 20-page contract was signed on June 4, 2017, and that this is page 20, with all of the signatures, but... What did that contract say in Paragraph G on Page 12? Perhaps the bank only retained page 20, and is saying that they used the same master form for every mortgage and the master form says "this" on page 12. Or one party…

On "serious" contracts, it's common to put your initials on each page, or to fan out the stack of papers and sign the margin so that each page contains part of that signature. Both are in addition to the "real" signature at the end, and provide some protection against exactly these kinds of problems.

I guess a cryptographer would add a hash of all preceding pages on the last page.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#40

Post by zzbn00 »

justincormack wrote: post #29
psychphysic wrote: post #24

Earlier quoted context omitted.

In the UK at least it you email agreeing to terms and then appear to be complying you're unlikely to get out of it. Common examples are someone is sent a contract of employment unfortunately often after starting and they don't sign it. If they have been coming into work broadly in line with that contract so long as it's fair, employee and employer are bound by it. Here is an interesting edge case in the UK [0]. Long…

"An Englishman's word is his bond" as the old saying goes, verbal contracts are enforceable. The whole financial system used to run on purely verbal contracts. There are some requirements, there has to be a consideration for example. I am not sure this is true in other legal systems though.

As an interesting edge case, in an auction contract can be formed without words either: it is formed on the "fall of the hammer" https://www.legislation.gov.uk/ukpga/1979/54
Post reply on HN