2
$\begingroup$

A system fell into my neck, where lots of files are splitted into several segments and encoded via RC4. RC4, because client side - slow computer, slow flash arithmetic ops - can only decode big blobs with this simple algo in a reasonable amount of time. I have some reservations regarding the RC4 security, so I'd like to hear your opinions about it.

Files can vary in size (1-16 MB), the segment size varies. Each file segment is encoded with a different, random 256 bit key, also a ciphertext based HMAC-SHA256 is appended to each segment.

Client (flash) and Server (php, mcrypt) communicates via DH keyexchange. A 3072 bit PRIME (https://www.rfc-editor.org/rfc/rfc3526) is used for generating the secret key. The secret key then hashed with SHA256. With the hashed secret key, the server sends the file segment decode keys - encoded with RC4. Finally, the client checks, then decodes (and checks) the segments.

What are the possible attack scenarios, pitfalls? Since every file segment is encoded with a totally different key. Is the FMS attack an issue here?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ Your description seems to be missing some possibly relevant details. For instance, what key is used for the HMAC? Is the HMAC output also encrypted, and if so, how? And how are the segment lengths transmitted? $\endgroup$
    – Ilmari Karonen
    Aug 27, 2013 at 12:59
  • $\begingroup$ HMAC key: the same key used for the segment. HMAC is not encrypted. Client fetches the segments as separate files, so length info not necessary. $\endgroup$
    – MollyRazor
    Aug 27, 2013 at 13:36
  • $\begingroup$ You're still missing a lot of details. Can you provide the exact algorithms? e.g., what is the HMAC computed on? (on the ciphertext/on the plaintext?) How is the HMAC key for each segment chosen: is it the same for all files and all segments, or does it vary? How is the RC4 key for each segment generated? is it a function of some master key, and if so, what's the function? Can you specify the exact DH key exchange more precisely? How is the DH exchange authenticated? There are many possible problems; your question doesn't specify enough detail to analyze the scheme at a technical level. $\endgroup$
    – D.W.
    Aug 29, 2013 at 23:56

1 Answer 1

Reset to default
3
$\begingroup$

Using the same key for encryption and MAC is generally bad style, but may be secure in your implementation.

FMS isn't relevant for file segment decode because you don't reuse the same key. FMS isn't the only attack, though.

I have to ask though - is there some reason why you don't use SSL?

Improve this answer
$\endgroup$
1
  • $\begingroup$ I would answer obsolescence. His choices except for the (completely redundant) hash were all known in the late 90s. A choice of SSL then would have doomed his code to be insecure. However, there are better choices now. $\endgroup$
    – Joshua
    Jan 21, 2015 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.