Hacker News Reader

Comment by kcorbitt | Hacker News Reader

The author isn't implying that the NSA intentionally injected the word "PRISM" into the header of every HTTP/2 connection. Rather, that the members of the IETF that collaborated on the standard chose to change the existing dummy text to match those initials once the existence of the program was leaked to the public, presumably as a sort of inside joke/protest.

^ I figure I'd clarify that in case anyone else gets as confused as I did about what possible political or technical objectives the NSA might achieve by including a reference to a top-secret spy program in every HTTP/2 message (although it does seem like the sort of thing a comic-book evil intelligence organization would do :P).

View on HN

Wouldn't including a constant block at the beginning of every message of the plaintext help to break any ciphertext generated from the plaintext?

No, secure ciphers like AES are not vulnerable to known plaintext attacks

Hold on. AES is not intrinsically vulnerable to known-plaintext, like every modern cipher probably going back all the way to DES, but that doesn't mean AES constructions can't be attacked through known plaintext runs.

This particular text isn't a vulnerability (after all, HTTP is full of known plaintext), but I think you've overplayed your argument. :)

yeah, if knowing the leading 192 bits of the plaintext (24 octets, per article) lets an attacker break a session encrypted with 256-bit AES, you've got bigger problems than a known-plaintext attack, methinks. :)

This may be true for a single session, but it would seem that having every session begin with the same long text could allow correlations to be drawn on large data sets, potentially leading to full recovery of the sessions.

Do you know of the proof that rules out such a possibility?

no of course I don't know such a proof. But I wouldn't say 192 bits is long, in any case! It's absolutely tiny.

No, that is not a realistic vulnerability. I am now regretting nerding out about AES upthread, since I seem to have created the impression that there is some risk to having every HTTP request start with a fixed string. There is not.

>I seem to have created the impression that there is some risk to having every HTTP request start with a fixed string

Every HTTP request does not start with a fixed string. Every HTTP2 request apparently does (if I have read correctly).

>There is not.

Why not? What allows AES to escape such an attack?

There is not. This is something the first few lectures in Boneh's Coursera class should address for you.

> Why not? What allows AES to escape such an attack?

What attack? A known plaintext attack is just a type of attack. There aren’t any such known attacks against AES currently. http://crypto.stackexchange.com/a/10837/7264 is related.

Fair enough. Maybe there is some disagreement between the participants of this thread in what "known-known" means. I would say that without a proof that a known-plaintext attack cannot exist, one cannot say "There is not (a known-plaintext attack)." One could say, however, "I do not know of a known-plaintext attack against AES, however I do not know of a proof that rules one out."

Also, HTTP/2 traffic may be encrypted using another scheme (which may be vulnerable to large constant blocks in known locations). I don't think HTTP refers or deals at all with encryption. I'm not sure about HTTP2. My understanding is that they are application protocols only and that message integrity protocols occur at a different layer.

> Also, HTTP/2 traffic may be encrypted using another scheme (which may be vulnerable to large constant blocks in known locations).

This isn’t really a situation worth caring about when designing a protocol. If you’re choosing to encrypt something with weak encryption, you had better be darn sure that its vulnerabilities don’t apply. (And… why would you do that to begin with? No compelling performance reasons, even.)

Well, it eliminates most of the possible keys. Out of 2^256 possible keys, only 2^64 are now possible.

This would be serious if someone found a way to easily identify which keys were still possible. From there, you could find the real key simply by a process of elimination. It would be somewhat lengthy, but not unreasonably so. But so far as I know, nobody yet knows how to easily identify which keys are still possible.

Note: I'm ignoring IVs here, partly because I don't know if HTTP2 uses them. They may make the process of elimination impossible (at least in realistic amounts of time).

This looks like exactly the kind of vulnerability that Tony Arcieri is, correctly, saying doesn't happen with modern ciphers.

HTTP2 doesn't "use IVs" at all, in that encryption in HTTP2 is provided by TLS. TLS does use random IVs, and modern TLS uses them correctly.

Isn't supposed to happen. It would be a break of AES if it were to be shown to be possible. However it would mean that such a break would be instantly exploitable, rather than having defense in depth by requiring multiple independent failures. Our crypto systems should not be so fragile...

No. As has been repeatedly pointed out: HTTP is positively loaded with much longer runs of known plaintext.

>This particular text isn't a vulnerability (after all, HTTP is full of known plaintext).

This isn't quite a proof. You'd need to show that HTTP is not vulnerable to such an attack.

I don't think HTTP requires a starting block.

HTTP2 apparently requires a client's first message to be/start with:

    0x505249202a20485454502f322e300d0a0d0a534d0d0a0d0a

I'd guess that is much longer than any block that HTTP mandates.

Maybe I am reading things wrong?

doesn't HTTP require "VERB URL HTTP/VERSION" ?

Yes, but there are many VERBs and URLs.

but "GET / HTTP/1.1" is likely the most common.

I'd believe it might be the most common (though, I'd guess "GET /favicon.ico HTTP/1.1" to be a real contender). I highly doubt either are anywhere more than a small fraction of the total HTTP requests though.

Not actually requiring something to start with a fixed string doesn't really mean anything when every message begins with a fixed string because it's just the way to do.

If you use randomness (like in say CBC mode) that should suffice to give you IND-CPA security, no? And I believe GCM mode gives you IND-CCA2 security as well.

Actually CBC is a great mode for demonstrating how constructions built on secure primitives can introduce vulnerabilities. We can prepend a specific block to one with known plaintext in CBC mode to end up with garbage + plaintext we control.

There is a reason HTTP/2 requires GCM or other AEAD. TLS's MAC-before-encrypt is flawed because of these kinds of attacks.

What is it about this particular text that makes it not vulnerable? That it is short?

As shown in the commit itself[1] (and implied by the original article), the connection header always started with a constant text block. It was just changed to include "PRISM" instead of "START".

[1] https://github.com/http2/http2-spec/commit/ac468f3fab9f7092a... (as linked by others below)

The particular constant block may not matter much.

The curious thing here (for me at least) is all sessions beginning with a constant block of some length.

It seems like the thing an immature boy would do, but hey it just HTTP/2 protocol, no harm done!

I downvoted you, but I thought I'd explain why - I don't think it's reasonable to characterise this as childish. Government surveillance is something which our industry is the best positioned to speak out against. This type of thing seems to be clearly political speech, and not a prank.

It also is something that really hurts our industry, perhaps more so than any other industry out there.

Edit: To be clear, I mean the spying hurts our industry.

Legit question, why?(in this case) If you mean general lack of professionalism, sure, but in this case encoding this as a matter of protest seems appropriate.

Genuine question, how does it really hurt our industry?

You mean because "outsiders" will see us as childish or for some technical reason?

I meant the spying hurts our industry as those who buy IT services lose trust in the confidentiality of their data.

Yes; the entirety of our internet infrastructure is...almost...hopelessly insecure. The OpenSSL team refuses to even use SSL/TLS on their website because "they don't want anyone to get the slightest illusion that it's secure" and want everyone to manually verify the SHA hashes.

Have they posted their concerns regarding SSL/TLS? It would make interesting reading. I am assuming the issue is the certificate issuance hierarchy and correspondent lack of transparency, but that's just a guess.

Of course if those hashes are also served via plaintext, then comparing them also doesn't matter, and using them as verification is akin to praying to not be compromised

The OpenSSL team uses TLS on www.openssl.org. I don't know where you found that quote.

> The OpenSSL team refuses to even use SSL/TLS on their website because "they don't want anyone to get the slightest illusion that it's secure"

Eh?

1) Visting http://www.openssl.org automatically redirects me to https://www.openssl.org .

2) The OpenSSL source code is stored in a git repo in GitHub. While this doesn't ensure that the code hasn't been tampered with, git does make it substantially easier to detect tampering than other VCSs do.

3) All of the release tarballs are PGP signed. Verification of the authenticity of these files is just about as automatic as it gets.

I could be mistaken but I think, not too long ago, openssl.org used to redirect to openssl.net.

And if I recall correctly, it was http://openssl.net not https://.

Is it possible there have been some changes in recent years?

> Is it possible there have been some changes in recent years?

Well, I made my comment based largely on information that I verified a few minutes before I wrote the comment. I'm unaware of the site's history.

> This type of thing seems to be clearly political speech

So it's your assertion that a thing cannot be both "childish" and "political speech" at the same time?

As part of the in-group I can think it's kind of funny in a "stick it to the man" kind of way. But considering that much of what let's the NSA do what it does is because of the failure of organizations like the IETF (and bystanders like ourselves not to put more pressure on them) to make secure technologies prevalent, it's not that funny anymore.

This is exactly what the NSA wants. That you feel like you're on the right side and "sticking it to the man" while they laugh all the way to their long term data storage.

Apparently Feynman is pretty "childish" too: https://news.ycombinator.com/item?id=10650175

I don't think Feynman would have disagreed with that.

It might be political speech, but it's also childish.

What is it intended to accomplish? What is the actual statement being made, and who is the intended audience? Not the government - they already know what PRISM is. Also not the common internet user. If it had the potential to be effective at influencing or censoring political dialogue, I would be upset at the attempt to bake propaganda (however sympathetic the tech community might be to it) into what should be a politically neutral protocol. But it does seem more like a prank than anything else.

If IETF members were all immature boys, the Internet (along with many other things) would probably be a lot worst than it is today.

I disagree! I think there's a pretty good case to be made that if the IETF is not in fact comprised of immature hobbyists, its overall behavior is well described by a reversion to that lowest common denominator.

There are some great IETF success stories (mostly from a long time ago), but most of the best IETF products are the result of forceful and expert engineering done by just one or two people, carefully documented. You can see how much better that kind of work is than the IETF collaborative process by looking at the v2's and v3's of standards that started out the other way.

It's not a crazy observation to make. Think about the culture of heavily-engaged Wikipedia volunteers. Wikipedia is an amazing resource, probably the most impressive thing on the entire Internet, but most HN commenters would have no trouble calling it out for immaturity, insularity, and frivolity.

You disagree with the statement:

> If IETF members were all immature boys, [...]

and then you go on to make a point that agrees with OP, pointing out that IETF members are very mature engineers that are trying to solve hard problems.

No. You've misread me. I do not like the IETF, and feel like even though there are lots of well-intentioned and highly-competent engineers working within it, its process and current overall membership produces results that are sometimes indistinguishable from "immature hobbyists".

Specifically, I think the argument that the success of the modern Internet is evidence that the IETF is "mature" is dubious and worth debating.

(Hey: just to be totally clear: I do not think the string "PRISM" is evidence of immaturity.)

The Internet is apparently in its "infantile" brain stage. Would we notice when the Internet's "memory" (the Web) becomes a cantankerously irreverent mentally unstable adolescent?

And we're imprisoned in this madness!

It's called "satire". It's truth speaking to power.

BTW, "I'm rubber and you're glue..."

Updated: And what's gender got to do with it?

"Martin" is usually a boy's name.

Reply on news.ycombinator.com