Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

breakmeifyoucan.com

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#11

Post by fc417fc802 »

tialaramex wrote: post #9
tptacek wrote: post #7

Earlier quoted context omitted.

This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.

It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context. There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable…

I'm not a cryptographer but to me "broken" seems to imply that the core algorithm itself can be attacked. If merely applying it in certain ways as part of some larger system can fail then aren't most (possibly all) ciphers broken? It's entirely possible to do all sorts of stupid things.

Granted, a 2^32 block limit is pretty severe by modern standards.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#12

Post by tptacek »

1970-01-01 wrote: post #10
tptacek wrote: post #5

Earlier quoted context omitted.

It has? What exactly do you mean by that?

It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can' https://nvd.nist.gov/vuln/detail/cve-2016-2183

How exactly would you decrypt a 3DES ciphertext "with little effort"?

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#13

Post by tptacek »

tialaramex wrote: post #9
tptacek wrote: post #7

Earlier quoted context omitted.

This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.

It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context. There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable…

This semantic argument was more plausible before the original commenter claimed 3DES can be "broken with little effort".

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#14

Post by moribvndvs »

1970-01-01 wrote: post #2

3DES has been broken for a decade. Nice job putting it all together though.

> Is this a flaw in the cryptography itself? No. The underlying cryptographic algorithms (3DES and AES-128) remain secure. The vulnerabilities arise from:

Protocol design choices that allow unauthenticated memory writes after initial authentication Lack of atomicity when writing cryptographic keys across multiple memory pages Widespread misconfiguration in real-world deployments (unlocked memory, static keys) Non-NXP compatible chips with severely flawed random number generators

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#15

Post by tostrstrudel »

1970-01-01 wrote: post #10
tptacek wrote: post #5

Earlier quoted context omitted.

It has? What exactly do you mean by that?

It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can' https://nvd.nist.gov/vuln/detail/cve-2016-2183

BREAKMEIFYOUCAN! is the default factory key programmed into every MIFARE Ultralight C chip by NXP.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#16

Post by _tk_ »

tptacek wrote: post #7
zxcvasd wrote: post #6

Earlier quoted context omitted.

if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.

This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.

Not to be rude, but it seems to me that you are engaging in some hairsplitting. In general, security people do not recommend to use 3DES or RC4 - even if RC4 is broken in other ways than 3DES.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#17

Post by tptacek »

_tk_ wrote: post #16
tptacek wrote: post #7

Earlier quoted context omitted.

This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.

Not to be rude, but it seems to me that you are engaging in some hairsplitting. In general, security people do not recommend to use 3DES or RC4 - even if RC4 is broken in other ways than 3DES.

RC4 is actually broken. It's fundamentally broken. As you run it, it's face melts off like the guy at the end of Raiders. It's genuinely weird nobody noticed how bad it was, in a practical sense, until the late aughts.

The 64 bit block size in 3DES (and Blowfish and IDEA) limits how much data you can encrypt under a single key. I think the real "tell" that this isn't hair-splitting is that people don't ever generally talk about Blowfish being "broken", just obsoleted.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#18

Post by 1970-01-01 »

tptacek wrote: post #12
1970-01-01 wrote: post #10

Earlier quoted context omitted.

It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can' https://nvd.nist.gov/vuln/detail/cve-2016-2183

How exactly would you decrypt a 3DES ciphertext "with little effort"?

It's supported in hashcat

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#20

Post by _tk_ »

tptacek wrote: post #17
_tk_ wrote: post #16

Earlier quoted context omitted.

Not to be rude, but it seems to me that you are engaging in some hairsplitting. In general, security people do not recommend to use 3DES or RC4 - even if RC4 is broken in other ways than 3DES.

RC4 is actually broken . It's fundamentally broken. As you run it, it's face melts off like the guy at the end of Raiders. It's genuinely weird nobody noticed how bad it was, in a practical sense, until the late aughts. The 64 bit block size in 3DES (and Blowfish and IDEA) limits how much data you can encrypt under a single key. I think the real "tell" that this isn't hair-splitting is that people don't ever generall…

People just don’t talk about Blowfish.
Post reply on HN