![[ Back to EurekAlert! ]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v9LTTFmuqFFrV6wDml8KmUiDTAtUhW0egdoEQrQGBqK9tkJzyafLeC4_lknuxEgU5Ae89dXYboq3V0oFit1AQkGK3ZMC0ySpcGKM3WjTs=s0-d){kind=small}
Public release date: 19-Oct-2011[ | E-mail |
Share ] Contact: Dr. Joerg Schwenk
joerg.schwenk@rub.de
49-234-322-6692
Ruhr-University Bochum
XML encryption is insecure: Large companies affected
Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure", is the uncomfortable message from Bochum.
Standard for large integration projects
XML stands for "eXtensible Markup Language", and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.
Weak chaining of ciphertext blocks
Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. "We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages." The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure in all cases the result was the same: the attack works, XML Encryption is not secure. Details of the attack are presented at this year's ACM Conference on Computer and Communications Security.
No simple solution available
There is no simple patch for this problem", states Somorovsky. "We therefore propose to change the standard as soon as possible." The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.
###
Further information
Prof. Dr. Jrg Schwenk, Faculty of Electrical Engineering and Information Sciences at the RUB, Chair for Network and Data Security, Tel. +49 234 32 26692 joerg.schwenk@rub.de
[ | E-mail | Share ] ?
AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert! system.
Public release date: 19-Oct-2011[ | E-mail |
Share ] Contact: Dr. Joerg Schwenk
joerg.schwenk@rub.de
49-234-322-6692
Ruhr-University Bochum
XML encryption is insecure: Large companies affected
Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure", is the uncomfortable message from Bochum.
Standard for large integration projects
XML stands for "eXtensible Markup Language", and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.
Weak chaining of ciphertext blocks
Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. "We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages." The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure in all cases the result was the same: the attack works, XML Encryption is not secure. Details of the attack are presented at this year's ACM Conference on Computer and Communications Security.
No simple solution available
There is no simple patch for this problem", states Somorovsky. "We therefore propose to change the standard as soon as possible." The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.
###
Further information
Prof. Dr. Jrg Schwenk, Faculty of Electrical Engineering and Information Sciences at the RUB, Chair for Network and Data Security, Tel. +49 234 32 26692 joerg.schwenk@rub.de
[ | E-mail | Share ] ?
AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert! system.
Source: http://www.eurekalert.org/pub_releases/2011-10/rb-rrb101911.php
jcole jcole j cole j. cole j. cole joe namath austin weather
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.