Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SHA-3 Buffer Overflow

mouha.be

Post reply on HN
Print view View original

81–90 of 186 posts

Re: SHA-3 Buffer Overflow

#81

Post by adrian_b »

baby wrote: post #77
metadat wrote: post #5

If you're familiar with SHA-256 and this is your first encounter with SHA-3: The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: * Resistance to length extension attacks. * Performance. The SHA-2 functions—particularly SHA-512, SHA-512/224, and SHA-512/256—generally have higher performance than the SHA-3 functions. Partly this wa…

SHA-3 was also designed with hardware performance in mind IIRC, as in: if it becomes supported in hardware it will be much faster than SHA-2 hardware support.

Some of the more recent 64-bit ARM CPUs have added hardware support for SHA-3 (SHA3 is optional in architectures Armv8.2-A and later, i.e. in Cortex-A55, Cortex-A75 and later, i.e. starting with the smartphones from 2018).

Re: SHA-3 Buffer Overflow

#82

Post by metadat »

adrian_b wrote: post #80
franky47 wrote: post #62

Earlier quoted context omitted.

Note that truncated SHA-2 (SHA-224, SHA-384, SHA-512/224, SHA-512/256) are not susceptible to length-extensions attacks [1]. With the added benefit of better performance of SHA-512 (on 64 bit systems) [2], there's no good reason to use SHA-256 rather than SHA-512/256 for new cryptographic designs. [1] https://en.wikipedia.org/wiki/Length_extension_attack [2] https://crypto.stackexchange.com/questions/26336/sha-512-fa…

There is a good reason to use SHA-256 and not SHA-512. Many modern CPUs, e.g. all AMD Zen, most Intel Atom, Intel Ice Lake and newer, most 64-bit ARM, have hardware implementations of SHA-256, which are much faster than software computing SHA-512. Only some more recent 64-bit ARM CPUs also have hardware for SHA-512 and SHA-3. Whenever the speed matters, SHA-256 is the best choice, unless you choose different hash alg…

Interesting, in general I've noticed SHA-256 hashing is relatively CPU intensive and slow.. is the 2024 Xeon CPU in my server too old to include the hardware implementation?

Re: SHA-3 Buffer Overflow

#83

Post by adrian_b »

wahern wrote: post #47
Vecr wrote: post #13

Earlier quoted context omitted.

I think SHA-3 is almost always slower in software, in theory SHA-3 could be hardware accelerated of course, but on both current AMD and Intel systems it's not, where SHA-2-256 is.

AArch64 supports accelerated SHA-3, available on production systems since 2019 with the Apple A13, judging by https://github.com/llvm/llvm-project/blob/c35ed40f4f1bd8afd7... Power10 also supports accelerated SHA-3: https://www.redbooks.ibm.com/redpapers/pdfs/redp5649.pdf (p150) Accelerated SHA-3 on x86_64 is probably an inevitability; the question is more when than if.

Most Android smartphones support SHA3 starting with the 2018 models (i.e. Cortex-A55, Cortex-A75 or newer).

Re: SHA-3 Buffer Overflow

#85

Post by adrian_b »

metadat wrote: post #82
adrian_b wrote: post #80

Earlier quoted context omitted.

There is a good reason to use SHA-256 and not SHA-512. Many modern CPUs, e.g. all AMD Zen, most Intel Atom, Intel Ice Lake and newer, most 64-bit ARM, have hardware implementations of SHA-256, which are much faster than software computing SHA-512. Only some more recent 64-bit ARM CPUs also have hardware for SHA-512 and SHA-3. Whenever the speed matters, SHA-256 is the best choice, unless you choose different hash alg…

Interesting, in general I've noticed SHA-256 hashing is relatively CPU intensive and slow.. is the 2024 Xeon CPU in my server too old to include the hardware implementation?

I think that you might have mistyped the Xeon model number.

Nevertheless, most existing Xeon CPUs are too old to have SHA hardware.

In Intel server CPUs SHA was introduced many years later than in AMD server CPUs or Intel desktop CPUs, i.e. only in "the 3rd generation Xeon Scalable" based on the Ice Lake Server cores, in Q2 of 2021 (Xeon model numbers 83xx, 63xx and 53xx).

Re: SHA-3 Buffer Overflow

#86

Post by gonzo »

wahern wrote: post #47
Vecr wrote: post #13

Earlier quoted context omitted.

I think SHA-3 is almost always slower in software, in theory SHA-3 could be hardware accelerated of course, but on both current AMD and Intel systems it's not, where SHA-2-256 is.

AArch64 supports accelerated SHA-3, available on production systems since 2019 with the Apple A13, judging by https://github.com/llvm/llvm-project/blob/c35ed40f4f1bd8afd7... Power10 also supports accelerated SHA-3: https://www.redbooks.ibm.com/redpapers/pdfs/redp5649.pdf (p150) Accelerated SHA-3 on x86_64 is probably an inevitability; the question is more when than if.

SHA-3 is available on QuickAssist.

https://csrc.nist.gov/projects/cryptographic-algorithm-valid...

Re: SHA-3 Buffer Overflow

#87

Post by csande17 »

arisAlexis wrote: post #8

Can someone ELI5 the severity of this over the whole internet? What breaks/what not

The full advisory is linked at https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2.... In order for an application to be vulnerable, it must:

1. Break the file into multiple chunks and pass them to SHA-3 individually.

2. Make one of those chunks larger than 4 GB in size. (This requires using 4 GB of memory.)

This is kind of an unlikely thing for an application to do. If you're breaking the file into chunks, usually you'd use smaller chunks. (And if your server is limited to less than 4 GB of RAM, you might not be able to allocate enough memory to trigger the vulnerability in any case.) But it could be exploitable in some really weird or poorly written application somewhere.

Re: SHA-3 Buffer Overflow

#89

Post by adrian_b »

gonzo wrote: post #86
wahern wrote: post #47

Earlier quoted context omitted.

AArch64 supports accelerated SHA-3, available on production systems since 2019 with the Apple A13, judging by https://github.com/llvm/llvm-project/blob/c35ed40f4f1bd8afd7... Power10 also supports accelerated SHA-3: https://www.redbooks.ibm.com/redpapers/pdfs/redp5649.pdf (p150) Accelerated SHA-3 on x86_64 is probably an inevitability; the question is more when than if.

SHA-3 is available on QuickAssist. https://csrc.nist.gov/projects/cryptographic-algorithm-valid...

For those not familiar with QuickAssist, it is a cryptography and compression accelerator connected through PCIe, which is available in some models of Intel server CPUs or server chipsets and in a few models of Intel server Ethernet NICs.

Moreover, the laptop variants of Alder Lake (H-series, P-series and U-series) are said in the Intel Ark web site to include a subset of QuickAssist, but I have not been able to find any public Intel document explaining which functions are supported by laptop Alder Lake CPUs or any report of someone testing these functions on laptop Alder Lake CPUs.

Re: SHA-3 Buffer Overflow

#90

Post by morepork »

baby wrote: post #76
jbaczuk wrote: post #61

no bounty and still politely reports it. Good guys need more praise.

it's a public standard, who would pay such a bounty?

I'm sorry, we lost millions of dollars due to an exploit.

Don't you have bug bounties to find and fix these things?

But this was in a public standard that we were using, we don't cover those.

Do I look like I care?

Post reply on HN