[websec] CRIME II alleged at Black Hat

Phillip Hallam-Baker <hallam@gmail.com> Tue, 02 July 2013 13:52 UTC

MIME-Version: 1.0
Date: Tue, 02 Jul 2013 09:52:47 -0400
Message-ID: <CAMm+LwgzQNLJWMZtH8S+KsvtfMjNutWcEKVROA38hz3Te4Yt2Q@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: websec <websec@ietf.org>
Content-Type: multipart/alternative; boundary="001a1133b7da0100db04e087a941"
Subject: [websec] CRIME II alleged at Black Hat
Precedence: list

http://www.darkreading.com/vulnerability/https-side-channel-attack-a-tool-for-enc/240157583

We do not have the details yet. But it seems like this will be yet another
variant of the 'in the browser' adaptive plaintext attack against SSL
enabling cookie stealing.

There are two problems we need to fix:

1) Whatever the latest SSL issue is.

2) Stop using bearer tokens for authentication.


I anticipated this attack (it is the third time round after all) which is
why I wrote the session ID scheme as a drop in replacement for cookies. In
the short term sites would have to support both schemes as a transitional
measure but given the current transition to HTML5 it is entirely likely
that some sites can force a transition sooner.

http://www.ietf.org/id/draft-hallambaker-httpsession-01.txt


-- 
Website: http://hallambaker.com/

[websec] CRIME II alleged at Black Hat Phillip Hallam-Baker
Re: [websec] CRIME II alleged at Black Hat Tom Ritter
Re: [websec] CRIME II alleged at Black Hat Hannes Tschofenig