Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
breakmeifyoucan.com
Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
1–10 of 46 posts
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#23DES has been broken for a decade. Nice job putting it all together though.
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#3Looks awesome! I see some Flipper Zero apps were already created. When will you be releasing this for the Chameleon? Also, any plans to port this over to the Proxmark?
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#4Looks awesome! I see some Flipper Zero apps were already created. When will you be releasing this for the Chameleon? Also, any plans to port this over to the Proxmark?
All of the attacks are released for the three platforms (Proxmark3, Flipper Zero, and Chameleon Ultra). Our goal was day 1 support for RFID testing devices.
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#53DES has been broken for a decade. Nice job putting it all together though.
It has? What exactly do you mean by that?
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#63DES has been broken for a decade. Nice job putting it all together though.
It has? What exactly do you mean by that?
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#7Earlier quoted context omitted.
It has? What exactly do you mean by that?
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#8Earlier quoted context omitted.
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.
to any non-cryptographer, i think that's a distinction without a difference. it's disallowed from use by the major standards institute due to a vulnerability where people can recover the plain text.
that sounds "broken" to me, but i'm not a cryptographer. so, i'll defer to you when you say it's not broken. (i dont know what the cryptographer-specific definition of broken is -- it'd be great if you would shed some light on that)
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#9Earlier quoted context omitted.
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.
It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context.
There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable making the same claim for C++.
Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC
#103DES has been broken for a decade. Nice job putting it all together though.
It has? What exactly do you mean by that?
It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can'