Slashdot Mirror
New HTTPS Bicycle Attack Reveals Details About Passwords From Encrypted Traffic (softpedia.com)
campuscodi writes: Dutch security researcher Guido Vranken has published a paper [PDF] in which he details a new attack on TLS/SSL-encrypted traffic, one that can potentially allow attackers to extract some information from HTTPS data streams. Attackers could extract the length of a password from TLS packets, and then use this information to simplify brute-force attacks. The new HTTPS Bicycle Attack can also be used retroactively on HTTPS traffic logged several years ago. Hello NSA!
Everyone knows only terrorists use bicycles. Good citizens should stick to unicycles.
Seems to me that if you wanted to brute force something, you'd start with the minimum size allowed and go up from there. If there's 50 different characters allowed for any letter of a password, then testing all possible 7-length passwords takes 1/50th the time as testing all possible 8-length passwords, and so on. Negligible.
I guess it could be useful to know whether or not a given password IS brute forceable, though, and give you a rough ETA. An attacker could say "huh, this guy only has a 6 letter password, we can grab that in a minute", or "this guy has a length 20 password, we have no chance".
Don't most modern system pad encrypted data to hide its length? That's pretty much encryption 101 and one of the first things covered by the OpenSSL documentation. So, if encrypted data is padded, then how can you tell the length of a password sent over the wire?
Unless people are doing something really dumb and not using padding in their encrypted data, this doesn't seem like it should be possible.
Not sure how he would get the results with block ciphers but the paper only describes stream ciphers. That's the reason we don't use stream ciphers for HTTPS but rather block ciphers. Stream ciphers should simply never be used where keys repeat.
Custom electronics and digital signage for your business: www.evcircuits.com
How secure are the more modern search sites with perfect forward secrecy and proxy services? Thanks.
Domestic spying is now "Benign Information Gathering"
What this reinforces, is the need to use encryption widely and understand its limitations; and it has similarities to the issues with use of ECB mode ciphers mentioned on Wikipedia (https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_Codebook_.28ECB.29)
Like others, I'm less than certain of the real world impact of this particular issue.
What is also unclear, is if it is it possible to significantly reduce the amount of information that can be gained by not using stream ciphers, could the prevention be as simple as configuring web servers (etc) to not use stream based ciphers ? (e.g. Use AES in CBC mode).
It's a good thing Guido discovered the need for padding when riding bicycles because you could fall and hurt your head.
The attacker needs to know the exact length of all the other data. That means they need all the cookie data being sent, etc.
In the case of HTTP, I wonder if causing an ever changing header to be sent could help. For instance change a cookie on each exchange, with random length.
In the case of POP, IMAP or SMTP, we are screwed, though.
I think this is taking the Internet of Things too far.
You are welcome on my lawn.
thinking that this internet of things fad was out of control, but alas, it's just the name of the attack.
What a terrible choice of summary.
I hate those guys! They never stop at stop signs, always blow straight through the middle of intersections, and do their damndest to cut off anyone turning a corner. The worst part is when they cause an accident and play the victim because they can't be arsed to follow the laws when riding a 50 pound piece of aluminum among tons of steel.
Now I find out that they're going after my car's electronics and retroactively causing traffic problems! Fuck bicycles!
Client side hashing as a preventative measure?
Thanks, that site was hilariously paranoid drivel.
Knowing the length of a password cuts the keyspace in half -- assuming that one starts a brute-force search from shortest to longest -- because you can skip 2^(n-1) keys. That's huge, but if your passphrase is long enough, then that's still just the difference between the several times the heat-death of the universe and a couple of times the heat-death of the universe.
But even if that's an appreciable difference, this is still only useful for targeted attacks, and in those cases, there are better vulnerabilities to exploit from a cost/benefit perspective. This is especially true for state actors who can drop six figures for zero-days the way one might decide to purchase a stick of gum at the checkout line.
https://www.eff.org/https-everywhere
There are 57 comments as I post this and not one Bicycle Repairman reference?
Man. Slashdot has really gone downhill.
From TFA:
The name TLS Bicycle Attack was chosen because of the conceptual similarity between how encryption
hides content and gift wrapping hides physical objects. My attack relies heavily on the property of
stream-based ciphers in TLS that the size of TLS application data payloads is directly known to the
attacker and this inadvertently reveals information about the plaintext size; similar to how a draped or
gift-wrapped bicycle is still identifiable as a bicycle, because cloaking it like that retains the underlying
shape. The reason that I've named this attack at all is only to make referring to it easier for everyone
With politicians want to push for back doors, this illustrates why we don't need them. Normal encryption has its weaknesses, flaws and limitations, which a well resourced 'intelligence' agency can take advantage of. Add the back doors and you have just expanded on the weaknesses, flaws and limitations, that would drive people to another form of encryption.
Jumpstart the tartan drive.
Suppose an attacker is targeting a log in page. To load the page, your browser makes several http requests - the html page itself, a css file, a JavaScript file or two, some images that are on the page, etc. The cookie, user-agent etc are the same for all of these requests. Therefore the attacker already knows all they need to about the length of all your headers wven before you submit the login form.
By trying it themselves ahead of time, the attacker knows that a login with an 8-character password will be the SAME size as the GET request for login.php. The exact size is irrelevant, it's the relative size that matters.
Seems to me there's no such thing. Everything may be logged. Soviet Venona messages were eventually cracked due to one-time pads not being used only one time, but that wouldn't have happened without the traffic having been logged and kept for years. If quantum computers are created that can crack encryption we've used up until now, there's not much hope for anything used up to the present except true one-time pads. Perfect forward secrecy is when everybody who saw the message has died.