Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-zip broken password random number generator

threadreaderapp.com

Post reply on HN
Print view View original

41–50 of 67 posts

Re: 7-zip broken password random number generator

#41

Post by olliej »

paulpauper wrote: post #21
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

: unless you're absolutely sure otherwise, you should always assume any ZIP program you're using doesn't actually encrypt password-protected ZIPs. so 7zip AES is not actually AES? Obviously the source code shows it is

His point is that “zip” is an old data packaging format first, encrypted bundle second, many aeons ago the decryption was purely based - think “authenticated” PDFs that were plain text, but the application was meant to ask for a password before displaying the content.

Essentially, if you take an arbitrary “zip” implementation that offers password protection there are reasonably good odds that it isn’t using the “modern” aes based mechanism.

A predictable IV is only really useful if you can induce a target to repeatedly encrypt content using the same secret key, then an attacker can use known source content for some outputs to break the encryption for the unknown cases.

But again this requires a service that isn’t likely to really exist.

Re: 7-zip broken password random number generator

#42

Post by matthewaveryusa »

tptacek wrote: post #14
matthewaveryusa wrote: post #10

The attack here is: 1) You encrypt two pieces of data within the same second in the same process (so probably using the library?) 2) or if you're using the command-line, the attack is you encrypt two pieces of data within the same second, and somehow wrap-around your pid within the second to get the same pid again. That may be enough, or not enough -- but for those that claim that's not enough, one needs to recognize…

Monotonically increasing CBC IVs are in fact not fine; you have them confused with CTR nonces, which need single-use rather than unpredictability. See Bard for more details of the best-known attack on predictable IVs. If you're going to try to take someone down a peg, be right.

They are if you don't have an oracle afaik

Re: 7-zip broken password random number generator

#43

Post by tptacek »

matthewaveryusa wrote: post #42
tptacek wrote: post #14

Earlier quoted context omitted.

Monotonically increasing CBC IVs are in fact not fine; you have them confused with CTR nonces, which need single-use rather than unpredictability. See Bard for more details of the best-known attack on predictable IVs. If you're going to try to take someone down a peg, be right.

They are if you don't have an oracle afaik

I don't follow your response. If you're wondering whether it's OK to have predictable IVs, check:

* Rogaway's IPSEC chained CBC IV attack

* Bard's HTTPS predictable CBC IV attack

* Dai's attack on SSH

* Thai Duong and Juliano Rizzo's BEAST

... all of which are based on predictable IVs (usually: the last block of the previous message, which is taken as a synthetic IV in 1990s-era protocols). In short: no, CBC IVs must be unpredictable.

Re: 7-zip broken password random number generator

#44

Post by cataflam »

paulpauper wrote: post #29

It seems every few months we hear a story about something which is supposed to be secure not actually being secure or secure as expected. Someone should make a bug bounty for all the major encryption programs, 7zp, wnzip, etc. Allocate 5 or so encrypted bitcoin private keys (with brute-force resistant passwords) for each program and see how long it lasts, with he public keys made public so people verify the status. i…

Not exactly the same, but the EU has commissioned audits and just started a bug bounty program on some important open source projects.

https://juliareda.eu/2018/12/eu-fossa-bug-bounties/

Re: 7-zip broken password random number generator

#45

Post by 13of40 »

anyfoo wrote: post #23
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

Coupled with the very simplistic and predictable passwords often encountered in passworded (avoiding the word "encrypted") ZIPs, I often have the impression that the intention is more to add an explicit human step to open the ZIP. So, making it (less) accessible to crawlers, or give a non-malicious recipient a moment to think whether they want/need/should extract this. Often the password comes in the same mail or web…

I got a chance to ask the guy who invented the ZIP encryption scheme a couple of years back, and he basically said it was designed to be exportable under the US's encryption export restrictions at the time, which I understood to mean they made it intentionally weak.

Re: 7-zip broken password random number generator

#46

Post by Hello71 »

zokier wrote: post #39
paulpauper wrote: post #29

It seems every few months we hear a story about something which is supposed to be secure not actually being secure or secure as expected. Someone should make a bug bounty for all the major encryption programs, 7zp, wnzip, etc. Allocate 5 or so encrypted bitcoin private keys (with brute-force resistant passwords) for each program and see how long it lasts, with he public keys made public so people verify the status. i…

Cryptography doesn't quite work that way. Just because recovering cleartext is not feasible in some specific case does not make a cryptosystem secure in general.

In fact, that's basically what Telegram did with their impossible "crypto contests": provide a specific attack scenario, promise lots of money to break that (impossible) scenario, and then claim that it is secure against all possible attacks.

Re: 7-zip broken password random number generator

#47

Post by matthewaveryusa »

tptacek wrote: post #43
matthewaveryusa wrote: post #42

Earlier quoted context omitted.

They are if you don't have an oracle afaik

I don't follow your response. If you're wondering whether it's OK to have predictable IVs, check: * Rogaway's IPSEC chained CBC IV attack * Bard's HTTPS predictable CBC IV attack * Dai's attack on SSH * Thai Duong and Juliano Rizzo's BEAST ... all of which are based on predictable IVs (usually: the last block of the previous message, which is taken as a synthetic IV in 1990s-era protocols). In short: no, CBC IVs must…

If you reuse an IV on 2 files at rest, information that both files have the same prefix leaks. If you use a counter IV, or a random IV, you got nothing -- that's the only point I'm making ivs don't have to be random in the confines of the right context

Re: 7-zip broken password random number generator

#48

Post by int_19h »

tinus_hn wrote: post #32
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

Whatever the excuses, this is just stupid because it is so easy to get right. Don’t invent your own random number generator, use the one from the OS.

Keep in mind that 7-Zip is a fairly old app - it first shipped two years before Windows XP, which also happens to be the first version of Windows that had cryptographic APIs, and in particular, CryptGenRandom.

Re: 7-zip broken password random number generator

#49

Post by int_19h »

paulpauper wrote: post #21
tptacek wrote: post #11

This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file. The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode. In CBC, you want IVs to be unpredic…

: unless you're absolutely sure otherwise, you should always assume any ZIP program you're using doesn't actually encrypt password-protected ZIPs. so 7zip AES is not actually AES? Obviously the source code shows it is

7-Zip has its own format, completely distinct from ZIP.

Re: 7-zip broken password random number generator

#50

Post by int_19h »

MrRadar wrote: post #9
deckar01 wrote: post #5

It is not clear if anything is actually wrong here. It would be nice if someone who has spent more than "30 minutes" looking at this code could verify these claims and publish an article explaining the implications of these design choices. The twitter thread that this is aggregated from has replies that seem to indicate that there is no practical exploit here. https://twitter.com/3lbios/status/1087848040583626753

On the other hand, using the system cryptographic RNG (/dev/urandom, CryptGenRandom) is probably less effort than it took to write this strange half-baked RNG.

CryptGenRandom first appeared in WinXP.

And 7-Zip first shipped in 1999. Granted, AES support was only added in 2003, but the app still had to run on Win2K and 9x back then.

Post reply on HN