Slashdot Mirror
New HTTPS Bicycle Attack Reveals Details About Passwords From Encrypted Traffic (softpedia.com)
campuscodi writes: Dutch security researcher Guido Vranken has published a paper [PDF] in which he details a new attack on TLS/SSL-encrypted traffic, one that can potentially allow attackers to extract some information from HTTPS data streams. Attackers could extract the length of a password from TLS packets, and then use this information to simplify brute-force attacks. The new HTTPS Bicycle Attack can also be used retroactively on HTTPS traffic logged several years ago. Hello NSA!
Everyone knows only terrorists use bicycles. Good citizens should stick to unicycles.
Seems to me that if you wanted to brute force something, you'd start with the minimum size allowed and go up from there. If there's 50 different characters allowed for any letter of a password, then testing all possible 7-length passwords takes 1/50th the time as testing all possible 8-length passwords, and so on. Negligible.
I guess it could be useful to know whether or not a given password IS brute forceable, though, and give you a rough ETA. An attacker could say "huh, this guy only has a 6 letter password, we can grab that in a minute", or "this guy has a length 20 password, we have no chance".
Not sure how he would get the results with block ciphers but the paper only describes stream ciphers. That's the reason we don't use stream ciphers for HTTPS but rather block ciphers. Stream ciphers should simply never be used where keys repeat.
Custom electronics and digital signage for your business: www.evcircuits.com
How secure are the more modern search sites with perfect forward secrecy and proxy services? Thanks.
Domestic spying is now "Benign Information Gathering"
It's a good thing Guido discovered the need for padding when riding bicycles because you could fall and hurt your head.
The attacker needs to know the exact length of all the other data. That means they need all the cookie data being sent, etc.
In the case of HTTP, I wonder if causing an ever changing header to be sent could help. For instance change a cookie on each exchange, with random length.
In the case of POP, IMAP or SMTP, we are screwed, though.
I think this is taking the Internet of Things too far.
You are welcome on my lawn.
Client side hashing as a preventative measure?
Knowing the length of a password cuts the keyspace in half -- assuming that one starts a brute-force search from shortest to longest -- because you can skip 2^(n-1) keys. That's huge, but if your passphrase is long enough, then that's still just the difference between the several times the heat-death of the universe and a couple of times the heat-death of the universe.
But even if that's an appreciable difference, this is still only useful for targeted attacks, and in those cases, there are better vulnerabilities to exploit from a cost/benefit perspective. This is especially true for state actors who can drop six figures for zero-days the way one might decide to purchase a stick of gum at the checkout line.
https://www.eff.org/https-everywhere
From TFA:
The name TLS Bicycle Attack was chosen because of the conceptual similarity between how encryption
hides content and gift wrapping hides physical objects. My attack relies heavily on the property of
stream-based ciphers in TLS that the size of TLS application data payloads is directly known to the
attacker and this inadvertently reveals information about the plaintext size; similar to how a draped or
gift-wrapped bicycle is still identifiable as a bicycle, because cloaking it like that retains the underlying
shape. The reason that I've named this attack at all is only to make referring to it easier for everyone
With politicians want to push for back doors, this illustrates why we don't need them. Normal encryption has its weaknesses, flaws and limitations, which a well resourced 'intelligence' agency can take advantage of. Add the back doors and you have just expanded on the weaknesses, flaws and limitations, that would drive people to another form of encryption.
Jumpstart the tartan drive.
Suppose an attacker is targeting a log in page. To load the page, your browser makes several http requests - the html page itself, a css file, a JavaScript file or two, some images that are on the page, etc. The cookie, user-agent etc are the same for all of these requests. Therefore the attacker already knows all they need to about the length of all your headers wven before you submit the login form.
By trying it themselves ahead of time, the attacker knows that a login with an 8-character password will be the SAME size as the GET request for login.php. The exact size is irrelevant, it's the relative size that matters.
Seems to me there's no such thing. Everything may be logged. Soviet Venona messages were eventually cracked due to one-time pads not being used only one time, but that wouldn't have happened without the traffic having been logged and kept for years. If quantum computers are created that can crack encryption we've used up until now, there's not much hope for anything used up to the present except true one-time pads. Perfect forward secrecy is when everybody who saw the message has died.