Crypto protocols mostly crocked says euro infosec think-tank ENISA

[Lee J <lee () riskbasedsecurity com>]

http://www.theregister.co.uk/2013/10/31/most_security_protocols_insecure_suggests_enisa/

It's past time to plan the abandonment of legacy crypto, warns the European
Union Agency for Network and Information Security (ENISA) in a new 96-page
study providing recommendations for crypto designers that also says most
protocols are hard to install in a secure fashion.

The good news, however: behind the huge amount of detail that you'd have to
work through if you were actually implementing crypto, ENISA
says<http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report>
(PDF)
there are only two decisions that have to be made at the high level:

   - 1 – Is the legacy system you're already using fit for purpose, in
   terms of its crypto primitive, scheme, protocol and key size? If the answer
   is no, ENISA makes a strong recommendation that the system be updated “as a
   matter of urgency”.
   - 2 – Is the primitive, scheme, protocol or key size you're looking at
   suitable for new deployments?

The second case, ENISA writes, depends on characteristics like proofs of
security, key sizes of 128 bits of symmetric security or better, are
well-studied and without structural weaknesses, are standardised, and have
a reasonable existing installed base.

Mind you, the group is pretty demanding about what it considers “fit for
future” deployment: you – or rather, the best research you can find –
should expect the system to remain secure for between 10 and 50 years.

In a remark that won't surprise insiders but illustrates the complexity of
the world of crypto, ENISA notes that while primitives and schemes are
well-studied, the area of protocols is less so. To understand why this is
important, here are the divisions between these three fields:

   - Primitives – the basic building blocks that arise from the
   mathematical foundations of cryptography. These include block ciphers, hash
   functions, stream ciphers, factorings, discrete logarithms, and pairings.
   - Schemes – How the building blocks are assembled together, along with
   whatever proof exists that the scheme doesn't provide opportunities for an
   attacker to break the underlying primitives.
   - Protocols – Things like TLS, which stipulate how two ends of a
   conversation choose their encryption scheme.

Not only are protocols under-studied, the report states, but “most of the
deployed protocols which can be used by a naive user, are in fact either
incredibly complex to install in a manner which we would deem secure, or
are in fact insecure with respect to modern cryptographic standards.”

Lovely stuff.

The report also recommends a list of primitives, schemes and protocols it
believes are sufficient for future deployments. While too long to reproduce
here, ENISA's view of primitives is worth looking at.

For block ciphers, only AES and Camilla are considered suitable for future
deployments: 3DES, Kasumi, Blowfish still get a pass mark for legacy
applications only, and DES, of course, is a dead duck.

Crypto designers should stick to SHA-2, SHA-3 or Whirlpool for their
hashes, and where there's a choice, opt for longer outputs. SHA-1, SHA-2
and RIPEMD-160 are only suitable for legacy applications. Rabbit and SNOW
3G are future-suitable stream ciphers.

Designers should work with at least 128 bit keys for AES; 256-bit for
hashing, and their public key primitives should be at least 256 bits long,
ENISA says, and should plan that each of these be doubled in the future. ®

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

# OWASP http://www.appsecusa.org
# Builders, Breakers and Defenders
# Time Square, NYC 20-21 Nov
o()xxxx[{::::::::::::::::::::::::::::::::::::::::>

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security offers security intelligence, risk management services and customized security solutions. The 
YourCISO portal gives decision makers access to tools for evaluating their security posture and prioritizing risk 
mitigation strategies. Cyber Risk Analytics offers actionable threat information and breach analysis.