0
$\begingroup$

I am new in the cryptography and the information security problems, I try to understand things as much as I can and I know it's really complicated in the beginning.

Considering the communication protocol between a bank and its machines is standard and we have got an opponent who knows a little bit the way the information is encrypted. Of course this wouldn't cause a problem since the code that the bank uses is considered secure ( a secure Stream Cipher ).

The problem is the bank does not use a MAC. In that case, how would the hacker defraud the bank ? I thought that the MAC doesn't have any relation with the confidently ?

I appreciate your help/ explanations

Improve this question
$\endgroup$
8
  • $\begingroup$ MAC doesn't deal with confidentiality, it deals with integrity. So the attacker can attack integrity of the communications. Am I missing something? $\endgroup$
    – mikeazo
    Commented Feb 24, 2016 at 20:47
  • 1
    $\begingroup$ @mikeazo not having integrity protection might enable a break of confidentiality too, as it can enable chosen-ciphertext attacks like in this XML-encryption attack some years ago. $\endgroup$
    – Paŭlo Ebermann
    Commented Feb 24, 2016 at 20:59
  • $\begingroup$ So the problem is that the data can be integrated ? Even with a secure encryption method ? Like how would he integrate something to the message? $\endgroup$
    – Zok
    Commented Feb 24, 2016 at 21:05
  • 1
    $\begingroup$ Adding and removing bits would actually lead to random data being decrypted. But if you can flip bits and you know where the recipient and the amount of a transaction are located and you know the original values, you can calculate the difference and inject this one (i.e. flipping some bits) $\endgroup$
    – SEJPM
    Commented Feb 24, 2016 at 21:30
  • 1
    $\begingroup$ I'll quickly write a full and formal answer and I guess this will clarify everything (and our comment police can clean up here ;) $\endgroup$
    – SEJPM
    Commented Feb 24, 2016 at 21:38

1 Answer 1

Reset to default
2
$\begingroup$

For an attacker to be able to actually successfully break the security of the bank, we need to make a few assumptions, which I'll state here:

  • A stream cipher without proper authentication is used.
  • The attacker knows the data format the bank uses.
  • The attacker knows the recipient and amount of a transaction (i.e. the interesting values), which he may change.

First we need to consider how a stream cipher works. Most stream ciphers work by taking a key and an initialization vector and expanding this to a long keystream. The keystream $K$ is used to encrypt a message $M$ to the ciphertext $C$ as follows: $C=K\oplus M$ where $\oplus$ denotes bitwise XOR.

Now assume that the message being actually sent by the bank is $M$ containing a valid recipient and a valid transaction amount. Now further assume the attacker wants to replace this by $M'$ where he increases the amount and makes himself the recipient. One nice thing about bitwise XOR is that $a\oplus a = 0$ holds. Now the attacker can calculate the difference $\Delta=M\oplus M'$. He now replaces $C$ by $C'=C\oplus \Delta$. Now observe that $$C'=C\oplus\Delta=(K\oplus M)\oplus (M\oplus M')=K\oplus M'$$ which will decrypt to $M'$ by XOR'ing $K$ in again.

As requested by Maarten in the comments:

The (actual) Example

Assume that 0001001001100101100000001011010010 is the (legitimate) recipient ID.
Assume that 0000010111011100 is the legitimate transaction amount in USD.
Assume that 1001001100100100011110000010001010 is the attacker's ID.
Assume that 1100001101010000 is the attacker's preferred enrichment.
Assume that the message encoding consists of simple concatenation of the recipient ID and amount.
Assume that 01011000011010011001110010010110101100010100011100 is the keystream.
The message $M$ is then 00010010011001011000000010110100100000010111011100 and the (legitimate) ciphertext $C$ is 01001010000011000001110000100010001100000011000000.
The malicious message $M'$ would be 10010011001001000111100000100010101100001101010000 and therefore the difference $\Delta$ would be 10000001010000011111100010010110001100011010001100
Thereby $C'$ is 11001011010011011110010010110100000000011001001100 which will be decoded to 10010011001001000111100000100010101100001101010000 which is $M'$ and thereby the attacker will receive 50k USD.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Excellent explanation, but could you add something tangible like changing the amount or bank number within a transaction? $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 24, 2016 at 21:55
  • $\begingroup$ Okay I love the way you explained it, but I don't get it why would the attack know M ? You want to say that he has the C and the way it is encrypted, so he decrypts the C, obtain M , change values and calculate the difference and send the new C' ? $\endgroup$
    – Zok
    Commented Feb 24, 2016 at 22:01
  • 1
    $\begingroup$ @Zok Many times the structure of the messages is well known. Actually, you may know the contents as well. For instance it is quite possible for an attacker to send a bill for 10 euro to a company. This one is likely paid simply because it takes too much time to check the bill. What if the attacker than changes the amount to 100 times as much? As for banks: there are many banks so usually the operate on well defined standards (which very likely use MAC's by now, we can only hope). $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 24, 2016 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.