Hacker News Reader

Comment by tptacek | Hacker News Reader

It's worse than this article depicts. Without authentication, you can't even be sure you have confidentiality. Case in point: in the CBC scheme contemplated here, you can do more than change words in the plaintext; you can recover the entire plaintext, by feeding the decrypter a series of blocks with strategically corrupted padding.

View on HN

>Without authentication, you can't even be sure you have confidentiality.

Sure you can: a classic XOR one-time pad has no authentication and it's the definition of confidentiality-preserving.

It's true that malleability makes it easier to attack certain protocols which can then result in a loss of the confidentiality property. Your padding oracle example is a case in point, and there's seldom a reason to avoid an authenticated encryption mode for a message that's sitting inside a TCP packet.

On the other hand, sometimes malleability is a desirable property, and authentication is harmful. The APCO Project 25 radio standard, intended for use in the mobile radio world, has encryption as an option. The priority is to maintain confidentiality and to degrade gracefully in a hostile RF environment.

Encryption is applied after error-correcting codes using OFB mode, and so effects of interference apply bitwise within the data stream on decryption. An authenticating mode would be a disaster as a single bit error would result in the loss of an entire transmission.

Don't you need authentication to get the one-time pad in the first place?

No they are sent by snailmail.

Any offline method works. Transfer by handshake, travel with it in your bag from the main office, or injected as a chip under your skin since birth, any such method. :)

Don't you offload the authentication to the postal service in this case?

Key material distribution is a completely separate problem from authentication of a message.

Even if you use an authenticated encryption mode, you still have the problem of "how does this symmetric key get shared with only the intended parties?".

This is a little like saying unauthenticated CBC mode is fine as long as all you're doing is blitting out the raw ciphertext, padding (or otherwise) included, for a human being to read in a hexdump.

Any step you take past that is a computer program that holds a secret key acting on ciphertext chosen by an attacker and thus revealing some kind of behavior to them. There have been surprising "oracles" found in a variety of constructions beyond CBC mode. Modern cryptography chooses to avoid this problem entirely.

I considered using a padding oracle attack in the post, but it's aimed at a very basic level of understanding. I find padding oracles are much harder to describe to newcomers.

Also, the XOR malleability issue is present in lots of block modes of operation.

You can read downthread commenters on this post taking away the message that when you select cryptographic building blocks, you need to determine "if you care about" message tampering. Which is, of course, not the message people need to hear.

Another note would be to point out that the limited attack you presented is a lot simpler to understand and execute in CTR mode (and has the benefit also of being more common in practice).

I've added a section on padding oracle attacks towards the bottom.

I don't think there's a significant different in ease of understanding between most of the modes. I used CBC as it's one of the most common and familiar modes, and because it's where I have seen this issue many times. I don't see CTR used in the wild very often.

I also tend to use CBC for other demos as well, so it makes things consistent.

For the benefit of the thread: the variant of the CBC bitflipping attack that applies to the more common CTR stream cipher mode is: you simply XOR in whatever data you want, directly to the bytes you want to alter, and that's the end of the attack.

Is CTR more common?

It is much more common. It's also much easier to use.

Note that the common AEAD modes, AES-GCM and ChaCha20-Poly1305, are CTR + MAC. The most common style of MAC is Carter Wegman MAC, the second most common is CCM and EAX and the like, after that HMAC. Nothing new uses CBC or CFB or OFB or any of those.

Would AES-CTR [edited] with deterministic encryption via using the hash of the encrypted value as IV be secure under such schemes?

Are you meaning to say "RSA-CTR", as in, RSA as a direct stream cipher? Never do that.

Actually meant AES-CTR with hash-of-value as IV. Workable if deterministic encryption is a requirement?

Why not? Speed?

The hash of the encrypted value encrypted using what?

Reply on news.ycombinator.com