SHA-3 Buffer Overflow

Does this impact most distros? I'd imagine Python and PHP's native crypto bindings would be replaced with OpenSSL which should have assembly variants of SHA-3.

Re: SHA-3 Buffer Overflow

#5

Post by metadat » Thu, Oct 20, 2022, 9:49 PM UTC

If you're familiar with SHA-256 and this is your first encounter with SHA-3:

The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are:

* Resistance to length extension attacks.

* Performance. The SHA-2 functions—particularly SHA-512, SHA-512/224, and SHA-512/256—generally have higher performance than the SHA-3 functions. Partly this was out of paranoia and political reasons in the SHA-3 design process.

Further reading: https://crypto.stackexchange.com/questions/68307/what-is-the...

Re: SHA-3 Buffer Overflow

#6

Post by aliqot » Thu, Oct 20, 2022, 10:04 PM UTC

Interesting they both say "Official Sha3" and "by its designers", which as I remember it isn't that accurate. Keccak was chosen and then NIST added what is affectionately known as the 'mystery padding' before certification. What we know as official is not the way the designers submitted the proposal.

This isn't an attempt at a scary accusation, but as a pedant, this got me.

For those wondering, here is an explanation by a commenter:

    The padding change is the only difference, this allows future tree hashing modes as well as the current SHAKE outputs to generate different digests given the same security parameters and message inputs. Up to 4 additional bits are added, which keeps the full padding inside a byte boundary, making implementations with octet only input able to switch to SHA-3 from Keccak with change to only a single line of code.

https://crypto.stackexchange.com/questions/10645/are-nists-c...

https://cdt.org/insights/what-the-heck-is-going-on-with-nist...

ketccak team's response: https://keccak.team/2013/yes_this_is_keccak.html

Re: SHA-3 Buffer Overflow

#7

Post by ok_dad » Thu, Oct 20, 2022, 10:05 PM UTC

cipherboy wrote: post #4

Does this impact most distros? I'd imagine Python and PHP's native crypto bindings would be replaced with OpenSSL which should have assembly variants of SHA-3.

I use pyenv and whatever it installed for 3.10.4 months ago seems to be fine with the example code snippet run in the console. It took a few seconds, but didn't crash.

Re: SHA-3 Buffer Overflow

#8

Post by arisAlexis » Thu, Oct 20, 2022, 10:06 PM UTC

Can someone ELI5 the severity of this over the whole internet? What breaks/what not

Re: SHA-3 Buffer Overflow

#9

Post by flatiron » Thu, Oct 20, 2022, 10:08 PM UTC

arisAlexis wrote: post #8

Can someone ELI5 the severity of this over the whole internet? What breaks/what not

If you don’t use that library then nothing. If you do and you hash my crafted binary I probably could crash it.

Re: SHA-3 Buffer Overflow

#10

Post by moonchild » Thu, Oct 20, 2022, 10:11 PM UTC

metadat wrote: post #5

If you're familiar with SHA-256 and this is your first encounter with SHA-3: The main differences between the older SHA-256 of the SHA-2 family of FIPS 180, and the newer SHA3-256 of the SHA-3 family of FIPS 202, are: * Resistance to length extension attacks. * Performance. The SHA-2 functions—particularly SHA-512, SHA-512/224, and SHA-512/256—generally have higher performance than the SHA-3 functions. Partly this wa…

My understanding was that sha-3 should be faster than sha-2, in a general sense, but sha-2 has hardware acceleration. Is that incorrect?