Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

breakmeifyoucan.com

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#41

Post by somat »

_tk_ wrote: post #20
tptacek wrote: post #17

Earlier quoted context omitted.

RC4 is actually broken . It's fundamentally broken. As you run it, it's face melts off like the guy at the end of Raiders. It's genuinely weird nobody noticed how bad it was, in a practical sense, until the late aughts. The 64 bit block size in 3DES (and Blowfish and IDEA) limits how much data you can encrypt under a single key. I think the real "tell" that this isn't hair-splitting is that people don't ever generall…

People just don’t talk about Blowfish.

They do, but indirectly, the b in bcrypt stands for blowfish.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#42

Post by fc417fc802 »

upofadown wrote: post #32
fc417fc802 wrote: post #11

Earlier quoted context omitted.

I'm not a cryptographer but to me "broken" seems to imply that the core algorithm itself can be attacked. If merely applying it in certain ways as part of some larger system can fail then aren't most (possibly all) ciphers broken? It's entirely possible to do all sorts of stupid things. Granted, a 2^32 block limit is pretty severe by modern standards.

Si (2^32)*8 works out to 34GB for TDES. How many applications involve encrypting that much data in one go?

Sorry, calling that a block limit was an error by omission on my part. 2^32 yields a 50% chance of reuse. If we pick a sane security margin it's a lot smaller. Assuming I did the math correctly just now, 2^-32 only gives you ~2^17 blocks; dropping that to 2^-24 yields ~2^21 blocks.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#43

Post by upofadown »

fc417fc802 wrote: post #42
upofadown wrote: post #32

Earlier quoted context omitted.

Si (2^32)*8 works out to 34GB for TDES. How many applications involve encrypting that much data in one go?

Sorry, calling that a block limit was an error by omission on my part. 2^32 yields a 50% chance of reuse. If we pick a sane security margin it's a lot smaller. Assuming I did the math correctly just now, 2^-32 only gives you ~2^17 blocks; dropping that to 2^-24 yields ~2^21 blocks.

Off the top of my head, NIST was suggesting something like 8GB as the working limit. It would depend on your risk tolerance and the application in practice I guess. For something like video you might not really care about exposing a few 8 byte blocks here and there where the exposure is one block XORed with the other.

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#44

Post by fc417fc802 »

upofadown wrote: post #43
fc417fc802 wrote: post #42

Earlier quoted context omitted.

Sorry, calling that a block limit was an error by omission on my part. 2^32 yields a 50% chance of reuse. If we pick a sane security margin it's a lot smaller. Assuming I did the math correctly just now, 2^-32 only gives you ~2^17 blocks; dropping that to 2^-24 yields ~2^21 blocks.

Off the top of my head, NIST was suggesting something like 8GB as the working limit. It would depend on your risk tolerance and the application in practice I guess. For something like video you might not really care about exposing a few 8 byte blocks here and there where the exposure is one block XORed with the other.

An aside, personally I quite like TDES for the purpose of generating secure handles and the like. The larger block sizes of pretty much every other common algorithm yield URLs and integers that are more difficult to work with. 64 bits is a manageable enough length and you don't have to implement the algorithm yourself (at which point you'd have rolled your own crypto).

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#45

Post by tptacek »

fc417fc802 wrote: post #44
upofadown wrote: post #43

Earlier quoted context omitted.

Off the top of my head, NIST was suggesting something like 8GB as the working limit. It would depend on your risk tolerance and the application in practice I guess. For something like video you might not really care about exposing a few 8 byte blocks here and there where the exposure is one block XORed with the other.

An aside, personally I quite like TDES for the purpose of generating secure handles and the like. The larger block sizes of pretty much every other common algorithm yield URLs and integers that are more difficult to work with. 64 bits is a manageable enough length and you don't have to implement the algorithm yourself (at which point you'd have rolled your own crypto).

Further aside, note that there are constructions designed specifically for that problem and its relatives:

https://www.cs.ucdavis.edu/~rogaway/papers/subset.pdf

Re: Break Me If You Can: Exploiting PKO and Relay Attacks in 3DES/AES NFC

#46

Post by rootlocus »

tptacek wrote: post #34
zxcvasd wrote: post #29

Earlier quoted context omitted.

this is a very common pattern in tptacek's comments, but it's not worth calling out as he absolutely refuses to recognize it, always falling back to a similar response you see here. with a quick google of "3des broken" and reading the first paragraph of wikipedia on 3des, i was able to guess (correctly!) what they original commenter was referring to.

It's pretty self-indulgent of me to respond to this comment, but just real quick: the pattern you're seeing is me in fact not being one of the top-tier experts in cryptography on Hacker News (just one of the loudest), and not knowing who this person is, and not having had a reason to think about 3DES in quite a long time. What you're reading as snark or lawyering is, rather, me meaning exactly what I said, and being…

Sorry for being off-topic but I find it so refreshing that people can still engage in arguments in good faith, without resorting to personal attacks.

Thank you!

Post reply on HN