Re: PR attack against XML Encryption

[Florian Weimer <fw () deneb enyo de>]

* Yves-Alexis Perez:

> On jeu., 2011-10-20 at 12:58 +0200, Florian Weimer wrote:
> > A German university has released a press release, alleging a
> > vulnerability in the W3C XML Encryption standard.  Apparently, error
> > reporting from existing implementations can be used as an oracle to
> > recover information from messages encrypted in CBC mode.
> >
> > Details have not been published, as far as I know.  Does anybody know
> > more? 

> but afaict the paper is not (yet?) available freely.

I took a brief look at the paper, and it's basically rehashing older
work on decryption error oracles.  Full message recovery is apparently
possible, but leaves traces in the server log.  It's the standard
which is at fault: encryption without authentication is just not safe
in general.

IBM has already changed error reporting in response to this issue:

<http://www-01.ibm.com/support/docview.wss?uid=swg1IC76651>

Of course, without an application-independent way to check the
integrity of the decrypted message (which would be provided by a
combiend encryption/authentication mode), this is only a partial
solution.

The authors also mention a second issue, where implementations confuse
signed and encrypted parts of a SOAP message, allowing attackers to
inject unsigned data which is presented as signed to the application.
This probably needs a separate fix.