71–80 of 91 posts
There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
"The change from the strong OpenSSL cipher list to a hardcoded one starting with weak ciphers is either a sign of horrible ignorance, security incompetence or a clever disguise for an NSA-influenced manipulation - you decide!" Survey says: Short-sightedness. Not really ignorance or incompetence (although that may be arguable), but it's certainly not "NSA-influenced manipulation". That's the sort of thing they reserve…
The N.S.A.'s Sigint Enabling Project is a $250 million-a-year program that works with Internet companies to weaken privacy by inserting back doors into encryption products. From http://www.nytimes.com/interactive/2013/09/05/us/documents-r...
Earlier quoted context omitted.
I'm sorry, but I'm only a passing student of cryptography, and I've known that both RC4 and MD5 have been broken for quite some time now. I don't remember the timeline, but if you're implementing code for algorithms and you decide to use the defaults "just because", you're being negligent - that is to say being pretty damn stupid.
Once again, with feeling: the fact that an algorithm is "broken" does not mean that a cryptosystem reliant on that algorithm is necessarily broken. In this particular case, the MD5 breakage is not currently relevant to TLS, and it might be decades before it ever is. And, while nobody particularly liked RC4, it was deployed to mitigate an even worse vulnerability in the MtE CBC construction in TLS. Cryptosystems exist…
RC4 may have helped TLS to succeed, but it's 2013 - surely there's something that is robust enough to be used instead by now?
Of course the simple explanation could just be for performance reasons.
This beautifully illustrates the power of open source. One guy was worried enough about security to start checking the crypto source, and was able to alert the community. I hope this leads to a more secure platform.
Admittedly it is quite a bit more convenient to look back in source code history rather than dig up and test old versions of the compiled code directly.
There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
What a surprise, tptacek defending Google no matter what... /s
Disclosure: I work for Microsoft.
Earlier quoted context omitted.
How about neither? The designers of the SSL3-era ciphersuites knew that MD5 was shady but had few better alternatives because those ciphersuites predate even the SSL3 standard itself and thus readily available SHA1, so they used constructions that remain secure 20 years later even with broken hash cores. And subsequent designers and implementors have swapped RC4 in and out of TLS as needed to mitigate performance pro…
Is it plausible that the NSA chose to leak enough "hints" that lead to apparently-independent discovery of things like BEAST and M-t-E, making reverting to older and known-broken cyphers like RC4 seem to be "the correct pragmatic decision" (quite possibly seeding those discussions with ideas that lead even completely innocent open source developers to choose and justify why they've just baked crypto that's completely…
Hopely Cyanogenmod devs, if not Google itself, will fix it, now that they are aware. In 2010 it may not be seen as a priority, but since last June it is for everyone.
http://review.cyanogenmod.org/#/c/51771/
... only to revert it later:
http://review.cyanogenmod.org/#/c/51794/
The revert noted "TLS v1.0 + AES is a bad combo, and entirely possible to happen with these priority lists".
In other words, the proposed "quick fix" was dangerous. There's some reading material on BEAST attacks here:
https://blogs.akamai.com/2012/05/what-you-need-to-know-about...
Earlier quoted context omitted.
On the contrary, "It has not been broken" is exactly what I would expect a programmer to say. If the security of an algorithm is weakened, then it's important to evaluate the use of the algorithm and make efforts to implement stronger security now . You should feel fortunate that you even get the time to move to something better before all hell breaks loose. This is the same kind of thinking I hear daily when people…
> This is the same kind of thinking I hear daily when people say things like, "Just use bcrypt" without thinking about the consequences I'll say what everyone's thinking: What are the consequences?
Earlier quoted context omitted.
Once again, with feeling: the fact that an algorithm is "broken" does not mean that a cryptosystem reliant on that algorithm is necessarily broken. In this particular case, the MD5 breakage is not currently relevant to TLS, and it might be decades before it ever is. And, while nobody particularly liked RC4, it was deployed to mitigate an even worse vulnerability in the MtE CBC construction in TLS. Cryptosystems exist…
I get your point about the security of the system as a whole: my point isn't that the algorithms are on the list, just that they're at the top of the list. RC4 may have helped TLS to succeed, but it's 2013 - surely there's something that is robust enough to be used instead by now? Of course the simple explanation could just be for performance reasons.
There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
Thank you for the insight. It is good to get some more details on how broken it is. I will add a clarification regarding MD5 to the article. Sorry about my alarmist tone - from time to time I need to get rid of my conspiracy theories.