Re: PR attack against XML Encryption

[Yves-Alexis Perez <corsac () debian org>]

On jeu., 2011-10-20 at 12:58 +0200, Florian Weimer wrote:
> A German university has released a press release, alleging a
> vulnerability in the W3C XML Encryption standard.  Apparently, error
> reporting from existing implementations can be used as an oracle to
> recover information from messages encrypted in CBC mode.
>
> Details have not been published, as far as I know.  Does anybody know
> more? 

Paper was just presented at ACM CCS
(http://www.sigsac.org/ccs/CCS2011/paper_list.shtml). Proceedings are
available at
http://dl.acm.org/citation.cfm?id=2046756&dl=ACM&coll=DL&CFID=61633880&CFTOKEN=38378828

but afaict the paper is not (yet?) available freely.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part