Re: files encrypted with openssl enc?

"Douglas A. Tutty" <dtutty@xxxxxxxxxxxxx> writes:

Does anyone know if files encrypted with openssl's enc would be affected
by the openssl fiasco?

Yes, there is an effect, though it may be of limited practical
significance. If you used a strong passphrase and the CBC mode of
encryption (e.g., "-aes-128-cbc" or "-aes128", which defaults to CBC),
then your file should be safe. If you encrypted multiple files with
the same passphrase, an attacker may be able to tell when the
beginnings of two files match but should not be able to decrypt the
files.


The bug only affected random number generation, so for symmetric
encryption, this should only affect the random salt used.

The man page says that, by default, no salt is used, but that's wrong.
By default, OpenSSL *does* use random salt. The bad OpenSSL would
presumably have used salt from a limited set of possible values. This
is still much better than using no salt at all, but not as good as
using salt from the full set of intended values.

The passphrase and salt are used together to produce the actual key
and initial value (IV) for encryption. The main implications of using
salt from a limited set are that:

1. It's more feasible for an attacker to perform precomputed attacks
from a dictionary of passphrases.

2. It increases the chance that two files encrypted with the same
passphrase will use the exact same key and IV.

For point #1, it's not an issue for a targetted attack on a specific
file. It might be worth some people's time to perform this type of
precomputation if they're in the business of examining many OpenSSL
encrypted files every day, but if you aren't presently worried about a
visit from the NSA, I think there's little reason to worry about this.

For point #2, *if* this happens (two different files encrypted with
same key and IV), the impact depends on the block cipher mode used.
If you used OFB mode (e.g., -aes-128-ofb), security is destroyed. If
you used CFB, information about the first encrypted block (128-bits
for "-aes-128-cfb") of the files may be leaked. Neither ECB nor CBC
modes leak information in this manner.

However, for any mode (including ECB or CBC), an attacker can tell if
two encrypted files (using same key and IV) have the same beginning or
not. And for ECB, the attacker can tell whether or not any two blocks
are the same. This is a big problem if the attacker gets the
plaintext of one of the files, because he can use it as a "dictionary"
to decode blocks of the other file, regardless of where they appear.
For CBC, the attacker is limited to determining if the beginnings of
two files match. After the first difference in the files, he can't
mount a useful attack.

I hope that helps. You should probably double-check on an appropriate
OpenSSL list or something if you're really concerned, though.

--
Kevin Buhr <buhr+debian@xxxxxxxxxxx>


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx

Relevant Pages

  • Re: Importance of salt
    ... generate a key which is then used for encryption. ... The salt is used on ... The attacker really couldn't use his ... As for the iteration count... ...
    (microsoft.public.dotnet.security)
  • Re: Iterative Password Hashing vs Strong Salt
    ... my salts are not known by the attacker. ... I cannot use the word "salt". ... The purpose of hashing is to help in situations where the attacker has ... You are combining secret client data and secret server data to form an encryption key which is then used to encrypt and store some data on the server. ...
    (sci.crypt)
  • Re: encrypted filesystems
    ... More than strong enough if it's built into the encryption. ... attacker must substitute an alternate *encrypted* hash and plaintext ... The authorized recipient knows some kind of key and a short identifier ... components, identifier, salt, data, and checksum. ...
    (comp.os.linux.development.system)
  • Re: Sample scripts for C# <=> OpenSSL
    ... the details will likely come down to understanding exactly what ... the encryption algorithm is doing for initialization vector and padding. ... I'm aiming for use OpenSSL to encrypt files using AES (detailed on ... The salt is prepended to the output of the ...
    (microsoft.public.dotnet.security)
  • Vulnerability in encrypted loop device for linux
    ... An attacker is able to modify the content of the encrypted device ... considered a aim of the encryption mode, so most modes (e.g. ECB, CFB, ... As we need to authenticate the device across mounts and not while it is ... It slows down mount operations but they are ...
    (Bugtraq)