Subject: Re: [Cfrg] possibly dumb question about the opus codec and padding

From: David Wagner <[email-masked]>
Date: Thu, 7 Jun 2012 02:04:47 -0700 (PDT)

[Let's see if this email makes it through the moderation filter...]

Jon Callas  wrote:
> I don't think a few bits of known plaintext is a serious issue. I mean
> heck, pick just about any XML document and it's got an entire *block*
> of known plaintext in it via its XML/DTD header.
>
> On the other hand, there are a number of problems including the
> Mister/Zuccherato attack on OpenPGP and the Paterson et al. attack on
> SSH that boiled down to known plaintext. Add to that the PKCS1 attacks,
> and any number of padding oracles, it can't just be waved away.

I don't agree.  In my view, the problems in the Mister/Zuccherato attack
and the Paterson et al. attack had little or nothing to do with known
plaintext.  Rather, the problems arose because those systems didn't use
cryptographic algorithms properly.  In particular, the systems failed to
use a mode of operation that provides secure against chosen-ciphertext
attacks, and consequently the system ended up being (surprise!) vulnerable
to chosen-ciphertext attacks.

The same is true of PKCS1 and padding oracle attacks.  Those failures
all occurred because of failure to use a mode that's been shown to be
secure against chosen-ciphertext attacks.

In my opinion, the lesson from those systems has nothing to do with
known plaintext.  The lesson is: any time you encrypt, make sure you
use a mode of operation that is secure against chosen-ciphertext attacks.
Any time you encrypt, make sure you use a mode that provides authenticated
encryption.  Encryption without authentication is almost always a bad
idea.  Sadly, many software developers are not familiar with these
lessons.

Further references:

Don't use encryption without message authentication
http://security.stackexchange.com/a/2206/

Side-Channel Attacks on Symmetric Encryption Schemes: The Case for
Authenticated Encryption, John Black and Hector Urtubia, Usenix Security
2002.  http://www.cs.colorado.edu/~jrblack/papers/padding.pdf

---

From: Jon Callas <[email-masked]>
Date: Thu, 7 Jun 2012 06:01:16 -0700

> 
> ....The lesson is: any time you encrypt, make sure you

I don't disagree, and in fact, your last sentence is pretty much what I'm saying.

The real issue is that a naive "You MUST X because of Y" is always countered with a naive "You MUST do ~X because of Z." Y and Z aren't the issues, the MUST is. I brought up a crap issue to make a point, not because I believe the crap issue.

Nonetheless, I've recently been concerned with that last sentence. Software developers aren't familiar with tetchy modes of crypto. The lesson is to give them  things that they are less likely to screw up. The fact that lots of crypto requires specialized practitioners is a bug, not a feature.

	Jon

---

From: Steven Bellovin <[email-masked]>
Date: Thu, 7 Jun 2012 17:00:34 -0400

> 2002.  http://www.cs.colorado.edu/~jrblack/papers/padding.pdf 

And two older papers of mine: 

Problem areas for the IP security protocols. In Proceedings of the Sixth 
Usenix Unix Security Symposium, pages 205-214, July 1996.
https://www.cs.columbia.edu/~smb/papers/badesp.pdf

Probable plaintext cryptanalysis of the IP security protocols. In 
Proceedings of the Symposium on Network and Distributed System Security, 
pages 155-160, 1997.
https://www.cs.columbia.edu/~smb/papers/probtxt.pdf

The first paper shows that, as David said, you have to authenticate
when you encrypt; the second shows that even absent known plaintext,
there's frequently probable plaintext.  In particular see the two packet
attacks, where you have no idea what something is but do know that it's
probably the same as in the previous packet.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb