Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The DROWN Attack

drownattack.com

Post reply on HN
Print view View original

141–150 of 206 posts

Re: The DROWN Attack

#141

Post by tptacek »

jsmthrowaway wrote: post #140
tptacek wrote: post #113

Earlier quoted context omitted.

Developers that are likely to expose exploitable side channels in curve software are just as likely to expose them in RSA software. But developers that use curve software are going to avoid a bunch of vulnerabilities that are specific to RSA. They should use curves, and avoid RSA. But I don't know why I'm letting you off the hook on this. Can you be as specific as you can about the additional moving parts you're refe…

The amount I tend to learn after you get invested in a thread and start busting out things I've never heard of is honestly my counterpoint to arguing on the Internet being unproductive. That it is Percival you are fencing makes me look forward to the rest of this thread, because EC vs RSA is an interesting dialogue and you both have a lot to say on it. It might look like arguing to both of you, but scraps of useful i…

Colin and 'pbsd are much smarter than me, and learning stuff is actually why I'm so happy to pick fights with them.

I was a blog-arguer before HN, and a Usenet person before blogs, and a BBS person before that, and most of what I've learned in my whole career is traceable somehow to Internet arguments.

I really do think I'm right about RSA, though.

Re: The DROWN Attack

#142

Post by jaxr »

I don't know that much about encryption at all. But I was wondering if the fact that the private key for a certain web server could be uncovered using this attack implies that all the encrypted data that could have been gathered by, say, NSA's PRISM, while the site was using that certificate is now available to them in 'plain text'?

Re: The DROWN Attack

#143

Post by jsmthrowaway »

tptacek wrote: post #141
jsmthrowaway wrote: post #140

Earlier quoted context omitted.

The amount I tend to learn after you get invested in a thread and start busting out things I've never heard of is honestly my counterpoint to arguing on the Internet being unproductive. That it is Percival you are fencing makes me look forward to the rest of this thread, because EC vs RSA is an interesting dialogue and you both have a lot to say on it. It might look like arguing to both of you, but scraps of useful i…

Colin and 'pbsd are much smarter than me, and learning stuff is actually why I'm so happy to pick fights with them. I was a blog-arguer before HN, and a Usenet person before blogs, and a BBS person before that, and most of what I've learned in my whole career is traceable somehow to Internet arguments. I really do think I'm right about RSA, though.

I come back to my debate point. I think tech is in a state now where we definitely have personal policy positions but as engineers, we are reluctant to frame what we do that way. This is in contrast to politics where most issues are acceptably on a spectrum, because that is more of a "soft" field. I suspect "RSA is obsolete" is one of those things where you've carved out a position on one end, much like Schneier carved out his position on one end of curves as discussed upthread. I'm not calling you wrong, mind, as that comparison might imply: just a surprising opinion and you've certainly earned it, and I like hearing about it, and I think of you as one colorful end of a spectrum on this and a few other points. And throughout my life the extreme opinions have often panned out (i.e. Snowden), so I don't dismiss them much any more.

Maybe you're crypto's Bernie. Feel the Ptacek.

Re: The DROWN Attack

#144

Post by [deleted] »

tptacek wrote: post #126
davidamarquis wrote: post #123

Earlier quoted context omitted.

What are the arguments against RSA OAEP?

Public key encryption transforms are one of the biggest foot-guns in cryptography. OAEP is at least not prima facie broken, but using it still exposes you to the the design risks of building with public key encryption. (There are attacks against OAEP, but they're less common and not intrinsic to the design the way PKCS1v15's are).

[deleted]

Re: The DROWN Attack

#145

Post by Nimi »

matthewdgreen wrote: post #95
tptacek wrote: post #67

The vulnerability here is tricky to exploit but actually simple to describe. There's a padding oracle in the form of RSA used by both TLS and SSLv2; by repeatedly sending permuted versions of a ciphertext to an SSLv2 server, you can gradually discover the plaintext†. Both SSLv2 and TLS have countermeasures for this attack. But SSLv2's countermeasures are sabotaged by the crappy ciphers it also supports. In both TLS a…

The problem is that RSA is also used for most certificates, including signing certificates. This attack also implicates digital signatures. While we've made good progress shifting towards DH/ECDH ciphersuites -- and TLS v1.3 will eliminate RSA entirely -- we have essentially no deployment of DSA/ECDSA certificates. It's all RSA. So "getting rid of RSA" sounds good, but won't happen in TLS/SSL anytime soon. Moreover,…

Moving away from obsolete crap isn't the solution, it's the definition of the problem.

One could argue that the CA/Browser forum has achieved some success with moving away from SHA-1. As a spectator, I don't understand why this process is not repeated for similar obsolete primitives or standards.

Re: The DROWN Attack

#146

Post by pfg »

jaxr wrote: post #142

I don't know that much about encryption at all. But I was wondering if the fact that the private key for a certain web server could be uncovered using this attack implies that all the encrypted data that could have been gathered by, say, NSA's PRISM, while the site was using that certificate is now available to them in 'plain text'?

Unlike Heartbleed, the actual private key is not leaked to the attacker. Rather, a SSLv2-enabled server allows you to build an oracle with which you can decrypt a TLS connection (modern crypto, secure, etc.) to a server that uses the same key.

With Perfect Forward Secrecy, any DROWN compromise is limited to the period where an attacker is actively running the attack against you. Previous PFS sessions cannot be decrypted. Without PFS, I'm not sure, but my gut feeling is that previous traffic could be decrypted if someone actively attacks you on an unpatched system now.

Re: The DROWN Attack

#147

Post by r1ch »

bencollier49 wrote: post #3

These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.

I don't like it because it puts too much useful information on one domain. Will the researchers still be paying for the domain in 5-10 years?

Re: The DROWN Attack

#150

Post by [deleted] »

tptacek wrote: post #67

The vulnerability here is tricky to exploit but actually simple to describe. There's a padding oracle in the form of RSA used by both TLS and SSLv2; by repeatedly sending permuted versions of a ciphertext to an SSLv2 server, you can gradually discover the plaintext†. Both SSLv2 and TLS have countermeasures for this attack. But SSLv2's countermeasures are sabotaged by the crappy ciphers it also supports. In both TLS a…

[deleted]
Post reply on HN