Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

usenix.org

Post reply on HN
Print view View original

101–110 of 158 posts

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#101

Post by prepend »

beambot wrote: post #95
CobrastanJorji wrote: post #89

Earlier quoted context omitted.

On the contrary, "Progress" is a poor justification for complexity. To justify change, especially change that adds complexity and cost, there needs to be a problem that needs solving or an opportunity to make things better, where better means "cheaper" or "easier" or "simpler" or "fails less." Progress that doesn't make things better for somebody isn't progress, it's Juicero. If there isn't any notarization fraud out…

Managing electronic signatures (e.g. DocuSign & file storage) is a 10x improvement for me compared to printing, signing, mailing or faxing, and file cabinets. The complexity & reduced costs are definitely worth it. YMMV.

I just sign the pdf with preview and save it off to a folder. Works great.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#102

Post by robertlagrant »

hannob wrote: post #57

I feel there are some fundamental misconceptions about signatures that are baked into many of these older standards. There have been similar attacks on XML signatures, email signatures and PDF files (with some overlapping authors). It usually comes down to creating some complex formats where signatures are allowed to sign sub-parts of the information. This is an extremely fragile design, and should probably be consid…

I don't see why that's fragile? E.g. JWTs work this way.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#103

Post by kevincox »

robertlagrant wrote: post #102
hannob wrote: post #57

I feel there are some fundamental misconceptions about signatures that are baked into many of these older standards. There have been similar attacks on XML signatures, email signatures and PDF files (with some overlapping authors). It usually comes down to creating some complex formats where signatures are allowed to sign sub-parts of the information. This is an extremely fragile design, and should probably be consid…

I don't see why that's fragile? E.g. JWTs work this way.

No they don't. JWTs sign the whole token.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#104

Post by jabroni_salad »

meepmorp wrote: post #47
jabroni_salad wrote: post #34

Earlier quoted context omitted.

They are still using AES256 with 16 bytes of salt as far as I know. It's good security but it's not like you can rate limit attempts or anything and password bruteforcing has gotten pretty good lately. You also have to wonder if there isn't a skeleton key of some kind hanging around, too.

Aren't 256 bit AES keys computationally infeasible to crack? Assuming the rng and implementation aren't broken somehow, the best known attack is 2^254.3 operations to brute force a 256 bit key.

That math challenge assumes that the attacker will want to try all keys.

In reality, they are going to run rockyou.txt against it and just move on if that isn't sufficient.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#105

Post by tialaramex »

mplewis9z wrote: post #50
meepmorp wrote: post #47

Earlier quoted context omitted.

Aren't 256 bit AES keys computationally infeasible to crack? Assuming the rng and implementation aren't broken somehow, the best known attack is 2^254.3 operations to brute force a 256 bit key.

You’re assuming the key is 256 random bits, which is almost certainly untrue for a human-rememberable password. The 16 bytes of salt are public, and AES is designed to be _fast_, so this scheme is horribly insecure for password-based security.

It doesn't need to be 256 random bits. The chosen design smears the key, so if your password has 10 bits of randomness, my best attack is to try those 10 bits worth of passwords. That is practical to try, but if I have enough bits you might as well just guess keys, which you can't do, so, game over.

It does need to be actual randomness, so "NameOfCorp" won't work to protect Corp's documents, but people need to get over it, we just can't make that work, a fancy stretching algorithm won't make terrible passwords good. "Correct Horse Battery Staple" type passwords maybe are improved with stretching, you can imagine 44 bits of randomness might be feasible for a serious attacker, while maybe if it was 1000 times harder they'd give up. But in most cases humans don't need to memorize these passwords at all, so we can use a 32 hex digit password for example which is more than enough even though it's not 256 bits.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#107

Post by Avamander »

nailer wrote: post #8

I've heard the same for Windows code signing certs - that's it possible to modify the payload and have the signature still apply.

There's also the padding vulnerability CVE-2013-3900 that still isn't mitigated by default.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#108

Post by pid-1 »

D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

Not American, but DocuSign is becoming quite popular in my country and was deemed as a legal way of signing documents by courts.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#109

Post by bombolo »

D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

Uh? I have a smart card that I can use to digitally sign stuff. Fully regulated by law in italy. A scanned signature is not valid for us.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#110

Post by bombolo »

layer8 wrote: post #12
D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS

In italy we have PEC, which is legally regulated signed emails
Post reply on HN