I was reading the Here Come The ⊕ Ninjas document about the BEAST attack discovered by Thai Duong & Juliano Rizzo. There are two points I cannot understand.

At the section 5 - Application: Decrypting HTTPS Requests, they explain step by step to makes this attack possible.

I will be focus on Step 3 and Step 4:
(Reproduced as plain text here. A nicer LaTeX rendering is on page 7 of the paper.)

Step 3

Let IV be the last ciphertext block that Mallory captures, e.g., IV is Cn after step 2. Mallory computes Pi = IV XOR C2 XOR Pguess, where Pguess = P/1.1\r\nW[i]. Mallory appends Pi to the existing request, e.g., Pi is appended to the request body (this is the last assumption.) Alice’s browser would compute Ci Ek(IV XOR Pi) and send Ci to server.

Step 4

Mallory captures Ci. If Ci = C3, he knows that X is equal to W[i]. Otherwise he increases i and goes back to step 3.

Meaning that Mallory captures C1 and compares the encrypted block C1 = C3? Because IV is used to be XOR with P1 so why do they speak about Ci like it can be C1, C2, C3 .. Cn when it can only be C1?

In fact this reflexion comes from this :

Pi is appended to the request body -> the request body of an HTTP request? There is no sense to put this in the request body! Meaning IV is only use with the P1 block.

So what's the point of putting Pi in the request body ?

1 Answer 1


Yes Pi is appended to the body; (re)read the paragraph labelled Blockwise Privilege at the top of the page. Remember HTTP and thus HTTPS is a stream protocol; if you make a request to upload say 100 gigabytes uncompressed video you probably won't do it in a single step. To restate a little more finely:

  • Step 1 Mallory's code causes something in Alice's browser to open a connection and begin a request. It formats the HTTP request header plus the initial part of the body (which actually might be empty), plus an HMAC and padding not relevant to the attack, forming the first data record blocked as P1 .. Pn, encrypts those to C1 .. n, and sends those blocks. For the example, block P3 (encrypted to C3) contains a known value except one byte of cookie Mallory wants to guess.

  • Step 2 Mallory captures C1 .. Cn

  • Step 3A Mallory forms Pi = (IV=Cn) xor C2 xor Pguess (a guessed value for P3).

  • Step 3B Mallory's code tells the something Pi is the next block of the request body. It therefore creates a second data record beginning with Pi (or if you prefer, P2001 to mean the first block of the second record) plus other stuff we don't care about, encrypts it using IV (or IV2 for second record) = Cn, producing Ci .. ignored (or C2001 .. C200x). Mallory captures these.

    If Pguess was correct (Pguess = P3) then the block Ci/C2001 encrypted from Cn xor (Cn xor C2 xor Pguess=P3) is the same as the block C3 encrypted from C2 xor P3.

However, unless you have really old (and probably horribly unsafe) systems, you can no longer exploit BEAST, because practically everybody has implemented data fragmentation to block it. See https://stackoverflow.com/questions/15224909/jsse-wrap-creates-two-tls-packets-requiring-two-unwraps-why/15225921#15225921 .

(PS: That document is PDF, not LaTeX. But it makes no difference to the meaning.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .