Re: [hybi] It's time to ship

[Adam Barth <[e-mail]>]

On Wed, Jan 12, 2011 at 3:47 PM, Bjoern Hoehrmann <[e-mail]> wrote:
> * Adam Barth wrote:
>>Here's an example RFC that uses AES-128-CTR
>>
>>http://www.ietf.org/rfc/rfc4344.txt
>>
>>I believe it's technically defined by combining
>>http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf and
>>http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, the
>>later of which contains test vectors.  (Careful readers will notice
>>that my example is wrong.)
>
> I agree your example is wrong. So the concern was a chosen ciphertext
> attack. For simplicity let's say Websocket frames are just 16 byte long
> blocks and the attacker has full control over them. From the same 16
> byte input the browser would generate at most 2^32 ciphertexts, so an
> attacker can compute the masked frame for one of the nonces and send it
> over and over again, eventually his ciphertext will appear.
>
> Example: The handshake establishes the per-connection key K, I want to
> put "0123456789ABCDEF" on the wire, I compute "0123456789ABCDEF" `xor`
> AES(K, 0x12345678000000...) and ask the browser to send that again and
> again; eventually it will pick 0x12345678 as per-frame nonce, it will
> xor with the same AES value, and I get my attack payload on the wire
> (if the block counter is not reset, I'd just take that into account by
> recomputing the masked frame still assuming the same per-frame nonce.)
>
> So is there an error in this analysis, or is the argument simply that
> using your AES scheme seems to make attacks a little bit harder?

That's not really a chosen ciphertext attack.  A chosen ciphertext
attack means something specific in cryptography:

http://en.wikipedia.org/wiki/Chosen-ciphertext_attack

Your overall point is correct, however.  The security of the masking
depends on the size of the per-frame nonce.  That's the case for each
of the masking proposals.  32 bits seems like a reasonable trade-off
between security and per-frame size overhead.  With a 32 bit nonce,
you'll have to try this attack 2,147,483,648 times (on average) before
it works (that's around 2 billion).

Adam