Slashdot Mirror
Microsoft Drops Aging Encryption Schemes
christchurch wrote to mention an Eweek column about Microsoft's decision to stop using DES, MD4, and MD5 for encryption in Vista. From the article: "All three algorithms show signs of 'extreme weakness' and have been banned, Howard said. Microsoft is recommending using the Secure Hash Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption Standard) cipher instead, he said. The change is part of a semi-yearly update to Microsoft's Secure Development Lifecycle policies by engineers within Microsoft's Security Business & Technology Unit."
Presumably they haven't banned ROT13 then.
i thought they where just one way hashing algos
As opposed to the quarterly update by managers ?
Even if Vista and related products use higher encryption, Windows' obsessive temp file creation, along with swap files, seems to minimize the effect that using encryption has, right?
I mean, sure, it'll be much harder to brute force any MS encryption now, but did people do it that way before? Weren't there always other workarounds that will still be present?
Great... yet another reason to upgrade hardware when planning for a Vista install.
Gotta add more cycles to the those brute-force attack teams!
Never ask for directions from a two-headed tourist! -Big Bird
Developers who use one of the banned cryptographic functions in new code will have it flagged by automated code scanning tools and will be asked to update the function to something more secure, Howard said.
C:\ > make windows.vista
ERROR: Insecure code found.
Please upgrade code to Linux.
liqbase
Is that even allowed by US Gov. to export that to other countries? I thought that there was a limit of encryption and everything above ...bits was banned from exporting (remembering 56-bits encryption Windows NT).
Custom electronics and digital signage for your business: www.evcircuits.com
DES, MD4, MD5 and, in some cases, the SHA1 encryption algorithm, which are "way too complicated to understand," said Michael Howard, senior security program manager at the company. "Instead, our R&D lab is doing great things with sophisticated XOR encryption that should be enough security for just about anyone."
I'm a big tall mofo.
this post is rot13 encrypted. twice. to improve security.
See pictures of tits
wasn't NTLM slightly based on/uses DES ? If thats the case, then does it mean that they are changing the algo used in SAM too ?
Comment removed based on user account deletion
If this is true then LM hashes, which use DES, are on their way out finally. It's going to break some backwards compatibility, but it will go a long way in fixing some of the most obvious, http://www.antsight.com/zsl/rainbowcrack/, privelage escalation problems.
V sbe bar jrypbzr bhe ebg13 bireybeqf -> If you can't read this you're obviously 1: dyslexic 2: a Windows administrator (which is a fancy name for 1) 3: ...
Custom electronics and digital signage for your business: www.evcircuits.com
I always wondered why they use hashing for the passwords. The other day someone at my school forgot their XP password and it took me less than 30 minutes to "crack" it.
In keeping with their usual policy...
They haven't banned it until they were in the "extreme weakness" zone. Because the urgent, grave, critical, spam-zombie script kiddie friendly since last year, heavy, moderate, or obscure-but-total-system-compromised weakness categories aren't enough for them to fix it. And they only react to "extreme weakness" twice a year tsk tsk tsk...
Sort of like the slammer virus fix not being part of their "hotfixes" service and delayed 6 months to be in a service pack, and a warning 2 weeks before the service pack to make sure evil doers get a head start they ignored 6 months before (due to too many other weaknesses easily used by the average script kiddy)...
Since security is their big concern this time around (according to many press releases and ads), where does that leave all other aspect of the next windows? How can it possibly get any worse?
Microsoft is pure dog-ma. FreeBSD is pure cat-ma.
Anyone that disagrees that removing these "encryption" methods is bad, is obviously just a troll. /sarcasm
Ok, question: what does Windows use hashes for, other than the updater (if even that)? Can't the updater just change what it supports, and leave the other hash tools alone?
How about some real security enhancements, Gates?
Anyway they can use whichever algorithm they want ... bad implementation/planning is the cause of their security holes.
...
Soon in Vista, 120xDES and AES implemented as default algorithms but windows media player will run any command sent remotely
Don't you know it is now both immoral and criminal to think beyond the next quarterly report?
Microsoft has promised additional encryption schemes for power users, including ig-pay atin-lay, leaving out every third word, and Navajo code talkers.
Slashdot Burying Stories About Slashdot Media Owned
Yeah, but Microsoft continues to use RC4 in protocols such as SSL and RDP...
Isn't it time to abandon RC4 too while they are at it?
-------
Warning: Slashdot may contain traces of nuts.
If they simply established a standard interface for the security code and put the code in its own module, they could update the security algorithm without touching anything else. Then they don't have to worry about telling people to change their code; just link it to the new security module.
Has any major distro changed or announced plans to change their password hash format in /etc/shadow?
Firefox and other mozilla based browsers already support 256-bit AES encryption for ssl websites, as does apache..
On the other hand, IIS and IE support nothing stronger than 128-bit RC4.. so be dropping RC4 they will lose compatibility with older versions of their own products, but maintain compatibility with their competitors.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
These are newcomers. Shouldn't that give us some pause as to how much we should rely on them? Yes they've been well studied. But compare AES with DES. It's been around forever and the only weakness that we know of is keylength. Do we really have enough exposure to the "new guys" to put confidence in them to switch everything to them?
Key to financial independence: Spend less than you earn. Save and invest the difference. Do it for a long time.
Hmm. I think that they have other things they need to worry about.
[%] Cingular Ringtones
I wonder if Microsoft sees new products as a fresh start and a chance to completely redeem themselves from prior flaws. I would expect them to have a series of meetings to say, "Where did we go wrong last time" and vow to eliminate those issues. Let's hope they use this opportunity to release something solid and stable from the beginning. We can't expect perfection, but they can definitely do better than they have in the past.
Finance tutorials and more! Understandfinance
Oh MAN! Double ROT13!!! That's like...no encryption at all, so there would be no point in using it! But you humourously suggested that it would be secure which is SO HILARIOUS - that's one gag I've never seen before on Slashdot, ever. Quite incredible. Sir, I salute you.
You forgot the punchline...
3) Profit!
Well ... I know that these criptography standards are begining to be dated, and it is very likely that we will see more successful brute force atacks on them in the following years. However, I wonder if changing them will have a noticeable positive effect on the security of Vista. How many of the many exploitable holes in Windows XP are due to bad criptography, and how many are due to bad design and policies?
If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
As far as my limited knowledge extends, MD5 is fairly safe as long as you use it for the right purpose and include a long enough salt (which is kept secret).
Other than building up MD5 databases, can someone explain what is wrong with MD5.
If you were to find a MD5 string that has been hashed using a salt, surely it would be impossible to find the original string?
MD5 is used in the HTTP digest authenticattion.
I hope they'll still support that!
All the passwords are stored/transmitted as hashes.
Switching to SHA1 hashes only will break compatibility with everything earlier than XP.. which is probably what MS really want - force everyone to upgrade.
If I had a dollar for every time someone called a hash algorithms an encryption scheme....
I checked and it looks like MD5 has the same problems any hashing function would. Namely that you can't take infiniti and squeeze it into a jar of fixnum bytes without more than one number between 0 and infiniti resulting in the same value for F.
I guess 25 of those minutes were spent downloading a Linux tool to reset the password, 4 minutes to reboot the PC and the other 1 minute you were scratching your head to figure out the cryptic commands of the utility...
Oh well, what the hell...
In other words, Microsoft Drops AES?
Man, I'm so confused now.
OK, you can stop throwing
Beware: In C++, your friends can see your privates!
The article is in plain English. I haven't seen it on MSDN yet, but I imagine this is the gist in developer-speak:
.NET framework. While not completely insecure, these algorithms have documented vulnerabilities which mean they can be cracked or exploited in certain scenarios. FxCop will warn you when it finds these classes in use, and provide a suggested fix. Typically, this will simply envolve switching the provider you are using with the more secure SHA256 or AES providers.
Microsoft will be marking the DES, MD4, MD5 and SHA1 encryption provider classes obselete in upcoming versions of the
Could this been due to the patent on SHA has expired? And NSA wants to keep control of all things being crypted?
Well, they are actually not that different. Any block cipher (like AES) can easily be used as a hashing algorithm (using the last block as the "digest") with fixed key/IV. It can be used as a MAC the same way by varying the key.
Hashing algorithms can as well be used as stream ciphers. Since they have the property that they are "cryptographically secure" - ie. their output could as well have been random for all you care - they can be used to create a stream of pseudo-random bytes that you can XOR your message with.
The real difference between hashing algorithms and "real" two-way encryption is efficiency! Hashing algorithms are also commonly called one-way encryption schemes.
It doesnt make much difference if they're going to use better encryption-- when the plain-text is so vulnerable to trojans, phishes, BHO's and viruses.
Heh heh...
If Microsoft is kind enough to continue using TEA encryption in the Xbox 360 for the bootstrap initialization, perhaps it will not be so unhackable.
Probably not, but my personal belief is that MS would be dumb to make it unhackable, as mod chips have probably been responsible for a lot of console sales, and in turn, a lot of good word-of-mouth PR in the trenches.
You can always just take your favorite symmetric key encryption algorithm and XOR successive blocks to produce a hash. This may have weaknesses for particular algorithms (IANAC).
A hashing algorithm, as we all know, is just a many-to-one function (not reversible in general). f(x)=0 is such a hash function. It exhibits disappointing collision characteristics, though. f(x)=x avoids this complication, although it is reversible. Uh oh, now Microsoft's gonna steal and patent my elite hashing algorithms.
Don't tell me you're one of those promoting the ridiculously foolish "security through obscurity" approach.
Ok, let me not be so quick to judge. Work for the men in black?
Also EAS was the result of a contest made by the _fine_folks_at_NIST_ (I owe a huge debt of gratitude to nist for their fine Open Source ATM network Simulator that I used in my thesis http://w3.antd.nist.gov/Hsntg/prd_atm-sim.html/).
7 6.htm/
The code that won was developed by a Belgian team, and therefore, not bounded by the restrictions, even if those restrictions were still enforced....
The press release from the _fine_folks_of_NIST_:
http://www.nist.gov/public_affairs/releases/g00-1
*** Suerte a todos y Feliz dia!
Doesn't the USA have a limit on how strong of encryption that can be exported? I remember reading at OpenBSD that they have to compile OBSD outside the USA in 6 different "free" countries because of this restriction. So would Microsoft's implementation be restricted?
...Bank of America is no longer storing money in bed matresses in the basement of each branch. They are upgrading to mason jars which will be heavily guarded by teams of trained marmosets.
blah blah blah
RC4 is a stream cipher which has been on shaky ground for a long time. There are two problems with RC4. The first is that the data is not as random as it could be, at the beginning. The way RC4 works, you put in a key and then it generates a string of random bytes which you XOR with your plaintext to encrypt. But there are weaknesses in the randomness of the first part of RC4's key stream. To fix this experts recommend throwing away the first N bytes. The problem is that nobody can agree on what N should be and it keeps going up. It used to be that 256 bytes was enough, then a thousand; now they say several thousand. Such progressive weakness is a bad sign in a cipher.
The other problem is that stream ciphers in general are hard to use correctly. There have been many notorious cases of RC4 being misused. If you use the same keystream twice you get very bad results (similar to using a one time pad twice), and you can xor bits of the ciphertext and have them go straight through to the plaintext. Again and again people make these mistakes.
RC4 has probably been the cause of more security flaws than any other crypto algorithm. The most recent one (the first link above) was just this year. It is time for Microsoft to retire RC4 in new protocols and products.
Right now you can generate SHA256 hashes, but you can't sign anything using SHA256 because it's not supported. Mono of course handles this without any problem.
Well, there is ONE possible exception to this. You can use hashes for error-correction. If you have enough hashes over enough slices of the data, you could actually regenerate the original dataset from just the hashes. Whether there would be any advantage in using such a method is debatable, though I suspect there may be a variant you could use where conventional error-correction codes would be unable to handle the noise levels.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Note the widespread availability of AES. While not developed by US researchers, the actual AES standard is the US government's new offical standard for symetric key encryption. It's authorized for use in both secret and top secret applications.
This was a major change in operation, as it used to be that the algorithms used for secret encryption were themselves secret.
What seems to have happened is the government has been made to realise that strong crypto exists all over the world. Thus to restrict is artifically is just to hurt US companies and intrests. Thus they are now allowing their standard to be made public.
Others have theorized that it's also because the NSA is having trouble hiring all the best mathematicians and cryptographers, and thus can't reliably evaluate crypto be themselves.
Either way, you now find AES crypto in programs from all over the world, and the government is just fine with that.
AES has been evaluated and weighed in on by lots of heavyweights, including major universities, the NSA, and so on. They all claim it's secure. What's more, the US government has authorized its use for encrypting secret and top secret data. Presumably they wouldn't do so if they weren't confident in its security.
Do remember that AES was around long before it became AES. It was orignally Rijndael, which was first published in 1998. True, that's not the same as DES's multi-decade legacy, but it's still a long time, and it's faced a LOT of examination and held up.
This is an example of why states are mandating use of open source solutions. Microsoft depricates these older encryption standards in their newer systems. So anything that is stored for extended periods of time will end up not being able to be recovered or read. In an open system you would most likely be able to find a package that supported those older encryption standards. With Windows you would have to find someone to write a program to decode those files for you.
Guess that means I can't get admin passwords to the school network anymore... :(
Since both of these protocols require the use of MD5 (and SHA1) for HMAC in handshakes, regardless of which cipher suite and hash algorithm is selected to encrypt/hash the data records. See section 5 of RFC2246 (TLS) for more info.
-- Julien Pierre http://www.madbrain.com/blog
Not all data needs to be heavily encrypted and protected with AES and SHA256 algorithms. Microsoft is forgetting the fact that security has a time element associated with it - not every piece of data needs to be secured for a decade or two. Some data has a security shelf life measured in seconds, not years. Furthermore, they're forgetting that security is always a tradeoff - in this case particularly that between security and performance. DES MD5 may be quicker than AES SHA256. Not to mention compatibility between systems. But that's Microsoft for you - good at making our decisions for us. THANK YOU MICROSOFT!
Does this include Triple DES?