Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

usenix.org

Post reply on HN
Print view View original

81–90 of 158 posts

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#81

Post by mschuster91 »

D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

> Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off.

More and more people in the legal world want to move away from scanned signatures, faxes and other "legacy" elements. Managing paper (and keeping it safe for the time you legally have to store it) is a massive expense for companies. Fires or thefts at vaults are rare but they do happen (not to mention natural disasters like floods), and you don't want to be affected by a breach that ruins stuff as, say, real estate deeds simply because of the headache that entails to get them replaced.

In contrast to that, a digital deed can be replaced very fast, no matter if the company or the government loses their data center to a disaster.

> It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic signature solutions don't necessarily solve it.

Oh there absolutely is. Particularly in America, where all you need to create a bank account and a line of credit is the name of a person, their SSN and some other details that have long since been leaked to some dark web forum and a forged signature.

With a requirement for a digital signature, a criminal would additionally have to phish their target's digital signature as well - either by convincing the target to make the digital signature or by stealing it via a RAT. Yes, that's possible, but the human element adds a significant cost increase as the criminal now needs a callcenter somewhere in India, Turkey or other places known for being a scammer heaven.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#82

Post by GranPC »

est31 wrote: post #78
GranPC wrote: post #72

Earlier quoted context omitted.

People typically do not share documents, such as signed contracts, by providing an image of their entire filesystem containing the signed file.

They also don't want to share two files, one for the file, one for the signature. Ideally, it's integrated, which means there needs to be some management. And ideally, it's also applied to the data before it's compressed, so that you can apply advanced compression and deduplication to archived documents like zopfli for example.

Right, that much makes sense. The point is that the signed file being part of a larger container does not immediately make the signature of the signed file, as a whole, useless.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#83

Post by denton-scratch »

tptacek wrote: post #54

Signed OOXML Word files are ZIP files defined by what appear to be 3 manifests: a content-types.xml file, a document.rels.xml file that maps symbolic IDs to filenames, and the "Package Info" section of the signature block, which supplies hashes for all signed files. The rendering of an OOXML Word file starts from "document.xml". Here are the attacks, as I understand them: 1. OOXML doesn't sign content-types.xml. It a…

> Never sign XML

"XML" is ambiguous. You have to understand what exactly you're signing, which the average notary or whatever doesn't know. And you have to know what you're verifying, which is equally difficult.

Office documents are (extremely complicated) XML; so it's hardly surprising that they adopted a signature scheme that involves signing XML. But this sounds cowboyish; along the lines of "No reputable security expert was harmed in the creation of this signature scheme".

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#84

Post by beambot »

CobrastanJorji wrote: post #76
D13Fd wrote: post #11

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic…

Same thing with the notarization system. Is the notary system foolproof? Absolutely not! Imagine how much better notarizations could be with a bit of technology around it. A digital notary could take a photo of your document, register a hash/summary/thumbnail in realtime, and make it so that backdating or changing the document after the fact is a technical impossibility. What do we use instead? A guy who's probably e…

"The current system works well enough" is a poor justification to avoid technological progress. I imagine people said the same thing about automobiles during the era of horses & buggies... yet here we are.

A much better argument is the indelible nature of physical signatures. But even that factor has pluses & minuses in an increasingly-digital world. If anything, we need digital signatures - e.g. to watermark original images, videos, articles, etc in an era of deepfakes.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#85

Post by tptacek »

denton-scratch wrote: post #83
tptacek wrote: post #54

Signed OOXML Word files are ZIP files defined by what appear to be 3 manifests: a content-types.xml file, a document.rels.xml file that maps symbolic IDs to filenames, and the "Package Info" section of the signature block, which supplies hashes for all signed files. The rendering of an OOXML Word file starts from "document.xml". Here are the attacks, as I understand them: 1. OOXML doesn't sign content-types.xml. It a…

> Never sign XML "XML" is ambiguous. You have to understand what exactly you're signing, which the average notary or whatever doesn't know. And you have to know what you're verifying, which is equally difficult. Office documents are (extremely complicated) XML; so it's hardly surprising that they adopted a signature scheme that involves signing XML. But this sounds cowboyish; along the lines of "No reputable security…

I don't see what's ambiguous here. I'm saying: never sign anything XML-encoded. Never use XML signatures.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#86

Post by tptacek »

cratermoon wrote: post #52

This smells a lot like the XML Signature Wrapping Attacks known to affect SAML. In essence, the attack fools the signature check into thinking that it's checking the signature of a different document than the one it's given.

They tested XSW attacks against OOXML and couldn't find any, but yes, this line of attacks and XSW both sort of follow from the malleability/flexibility of XML. It's generally not secure to build signature systems "inside" of XML.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#87

Post by dfox »

CrampusDestrus wrote: post #48
layer8 wrote: post #12

Earlier quoted context omitted.

At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS

>Emails don’t provide that legal value. In Italy there is an officially legislated signed email service that has legal value

The service probably has nothing to do with email and is only tangentially related to eIDAS. At least that is the case in Czech Republic. One surprising fact about such systems is that they tend to produce blockchain-like audit log and predate bitcoin by several years.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#88

Post by leni536 »

est31 wrote: post #78
GranPC wrote: post #72

Earlier quoted context omitted.

People typically do not share documents, such as signed contracts, by providing an image of their entire filesystem containing the signed file.

They also don't want to share two files, one for the file, one for the signature. Ideally, it's integrated, which means there needs to be some management. And ideally, it's also applied to the data before it's compressed, so that you can apply advanced compression and deduplication to archived documents like zopfli for example.

Isn't docx literally a zip file?

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#89

Post by CobrastanJorji »

beambot wrote: post #84
CobrastanJorji wrote: post #76

Earlier quoted context omitted.

Same thing with the notarization system. Is the notary system foolproof? Absolutely not! Imagine how much better notarizations could be with a bit of technology around it. A digital notary could take a photo of your document, register a hash/summary/thumbnail in realtime, and make it so that backdating or changing the document after the fact is a technical impossibility. What do we use instead? A guy who's probably e…

"The current system works well enough" is a poor justification to avoid technological progress. I imagine people said the same thing about automobiles during the era of horses & buggies... yet here we are. A much better argument is the indelible nature of physical signatures. But even that factor has pluses & minuses in an increasingly-digital world. If anything, we need digital signatures - e.g. to watermark origina…

On the contrary, "Progress" is a poor justification for complexity. To justify change, especially change that adds complexity and cost, there needs to be a problem that needs solving or an opportunity to make things better, where better means "cheaper" or "easier" or "simpler" or "fails less." Progress that doesn't make things better for somebody isn't progress, it's Juicero.

If there isn't any notarization fraud out there causing expensive problems, then spending a bunch of effort to make notarizations better isn't solving any problems but is adding complexity and cost.

Re: Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures

#90

Post by dfox »

kjetil wrote: post #74
phrz wrote: post #33

Earlier quoted context omitted.

The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."

In the EU (and EEA), eIDAS distinguishes between - "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device QES is legally equivalent to a "wet signature", but in…

AdES is mostly an technical standard that specifies how to use existing PKCS and IETF standards to produce eIDAS conforming signature, timestamp or “seal” (ie. timestamped signature) and how that should be mapped onto CMS (CAdES), XML-Signature (XAdES) and PDF (PAdES). How legally binding the result of that process is then depends on things like QSCTs, their LoA used in that and such things. And then there are various carveouts, for example in CZ, you can just generate CSR with ‘openssl req’ get that signed by right CA and produce QESs with that (and assume all the risks inherent in doing that)
Post reply on HN