Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-zip broken password random number generator

threadreaderapp.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: 7-zip broken password random number generator

#31

Post by hannob »

tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

> Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we're doing with it, 7z is fine.

Well, it's a "real" cipher, but with a legacy, unauthenticated cipher mode. This means basically as soon as you encrypt any active content you can have an attack similar to efail.

Re: 7-zip broken password random number generator

#32

Post by tinus_hn »

tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

Whatever the excuses, this is just stupid because it is so easy to get right. Don’t invent your own random number generator, use the one from the OS.

Re: 7-zip broken password random number generator

#33

Post by tptacek »

hannob wrote: post #31
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

> Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we're doing with it, 7z is fine. Well, it's a "real" cipher, but with a legacy, unauthenticated cipher mode. This means basically as soon as you encrypt any active content you can have an attack similar to efail.

I agree, this is a good attack to game out.

Re: 7-zip broken password random number generator

#34

Post by 13of40 »

tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

> It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else

This is going to sound really ghetto, but if you zip up some files, drag and drop the zip archive into a (modern) Word document, then pick File->Info->Protect Document->Encrypt With Password, you end up with a shareable file with decent encryption. IIRC, key generation is done with 500,000 rounds of SHA512 (which takes about 0.8 seconds on a contemporary CPU) and the encryption is 256-bit AES.

Re: 7-zip broken password random number generator

#35

Post by tptacek »

tinus_hn wrote: post #32
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

Whatever the excuses, this is just stupid because it is so easy to get right. Don’t invent your own random number generator, use the one from the OS.

I mean, yeah, 7z should fix this, but they're still going to be using unauthenticated CBC, which is a much bigger problem, so I'm going to have a hard time getting too worked up about this.

Re: 7-zip broken password random number generator

#36

Post by techntoke »

13of40 wrote: post #34
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

> It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else This is going to sound really ghetto, but if you zip up some files, drag and drop the zip archive into a (modern) Word document, then pick File->Info->Protect Document->Encrypt With Password, you end up with a shareable file with decent encryption. IIRC, key generation is done with 500,000 roun…

Or just use GnuPG

Re: 7-zip broken password random number generator

#37

Post by quietbritishjim »

tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

> In fact, if you're using ZIP archives in your application, don't use ZIP's AES at all; encrypt yourself with a modern mode. ZIP AES isn't meaningfully authenticated.

It sounds like you are conflating the zip file format with the 7z file format (both of which can be created by 7zip, the program). The plaintext attack discussed in the tweets was for zip files created by 7zip, while most of the blog post was about 7z files. (Edit: are you suggesting that there is the same security issue in both? Because that was unclear from both your comment and the blog post, given that neither explicitly says so but, presumably, 7z format and zip format are quite different).

I think a lot of techies (I really mean "me") would already suspect that zip format could be problematic, even with AES encryption. But the same techies (me again) would reasonably expect 7z with AES to be safe so long as you have a sufficiently strong password, since it was created a lot later than zip with encryption designed in from the start. I still don't really understand if the issue in the blog post is really a problem for me (sharing files through one channel while sending passwords through another channel).

Re: 7-zip broken password random number generator

#38

Post by 13of40 »

techntoke wrote: post #36
13of40 wrote: post #34

Earlier quoted context omitted.

> It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else This is going to sound really ghetto, but if you zip up some files, drag and drop the zip archive into a (modern) Word document, then pick File->Info->Protect Document->Encrypt With Password, you end up with a shareable file with decent encryption. IIRC, key generation is done with 500,000 roun…

Or just use GnuPG

Yep, there are a lot of ways you can do it. The point is, what are the chances my accountant is going to have GnuPG already installed on their laptop versus MS Word?

Re: 7-zip broken password random number generator

#39

Post by zokier »

paulpauper wrote: post #29

It seems every few months we hear a story about something which is supposed to be secure not actually being secure or secure as expected. Someone should make a bug bounty for all the major encryption programs, 7zp, wnzip, etc. Allocate 5 or so encrypted bitcoin private keys (with brute-force resistant passwords) for each program and see how long it lasts, with he public keys made public so people verify the status. i…

Cryptography doesn't quite work that way. Just because recovering cleartext is not feasible in some specific case does not make a cryptosystem secure in general.

Re: 7-zip broken password random number generator

#40

Post by tptacek »

13of40 wrote: post #38
techntoke wrote: post #36

Earlier quoted context omitted.

Or just use GnuPG

Yep, there are a lot of ways you can do it. The point is, what are the chances my accountant is going to have GnuPG already installed on their laptop versus MS Word?

None, is the answer. There is a none percent chance. And if you're going to get someone to install something, it's not going to be GPG. Without loss of generality this applies as well to lawyers, IT managers, development leads, chief security officers, cryptographers, and some former PGP developers.
Post reply on HN