Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently stumbled on this post: XML Encryption Broken, Need To Fix W3C Standard

I was expecting to find lots of information online about it, but there isn't actually all that much detail. Since I'm using WCF with lots of message level security SOAP, I thought I popped the question.

Is the mentioned post the real thing, or is it just something exaggerated based on some obtained success in a controlled environment? Is XML encryption actually broken?

share|improve this question
    
At least older variants are broken against an active attacker thanks to padding oracles. I heard about a new version which uses proper authenticated encryption, but I'm not sure if that version is already published, or if they're still working on it. –  CodesInChaos Jun 26 '13 at 12:44
add comment

1 Answer

With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others:

  • Added Key Derivation
  • Added Elliptic Curve Diffie-Hellman Key Agreement
  • Added Algorithms
  • Changed Algorithms

and among most relevant to your question, changes to security considerations:

Added security consideration information on Chosen Ciphertext Attacks, including attacks against encrypted data and encrypted key. Provide specific notes on CBC Block Encryption vulnerability, and the Bleichenbacher attack.

The article you were reading is about exploiting a weakness in the CBC mode for the chaining of different ciphertext blocks. While it does appear to be the real thing, it applies to encryption schemes before XML Encryption 1.1:

“We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages.” The attack was tested against a popular open source implementation of XML Encryption, and against the implementations of companies that responded to the responsible disclosure – in all cases the result was the same: the attack works, XML Encryption is not secure.

While I don't see this as exaggeration, and it doesn't strike me as surprising either (see for example this answer to the question How less secure is an encryption if we know something about the original data? and Wiki on Adaptive chosen-ciphertext attack), it needs to be mentioned again that it applies to CBC encryption mode avalable in XML Encryption 1.0 that was handled by a different W3C workgroup (XML Encryption WG last active in 2008).

This work has by now been moved to XML Security Working Group whose baby is XML Encryption 1.1 as a direct answer to such attacks as described in the article. In fact, The XML Security Working Group even directly mentions these attacks on XML Encryption 1.0 in the XML Encryption 1.1 documentation.

Addendum: Whilst reading through some non-related cryptography articles, I've stumbled across Matthew Green's blog post on Attack of the week: XML Encryption dating back to October, 2011. Matthew Green is a cryptographer and research professor at Johns Hopkins University, and writes most fabulous texts on cryptography and related subjects. His explanation of what this attack on XML Encryption is all about is the best one I've yet read, and of course a recommended read for anyone interested to learn more about them. Here's a short excerpt:

Stop using unauthenticated CBC mode. Stop using any encryption standard designed before 2003 that hasn't been carefully analyzed and recently updated. Stop using any unauthenticated encryption at all. Wrap your SOAP connections with TLS (a recent version!) if you can.

Source: Attack of the week: XML Encryption, Matthew Green

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.