1
$\begingroup$

Suppose that messages transmitted over SSL are modified as follows:

  • the message is splitted in blocks, $B_1, ..., B_m$ (each with at most $2^{14}$ bytes)
  • for each block $B_i$ we do:
    • we apply a MAC to the block $B_i$ resulting in $X_i$
    • we encrypt $X_i$ with a symmetric cryptosystem in mode CBC resulting $Y_i$
    • we add a SSl header resulting in $Z_i$
    • we transmit $Z_i$ through a TCP segment

The encryption of the first block $X_i$ is done in this way:

  • we divide $X_1$ in 64 ori 128 block, $X_1=x_1^1....x_1^{l_1}$
  • we generate $Y_1 = y_1^1..y_1^{l_1}$, where $y_1^1=e_K(x_1 \oplus y_0)$, $y_0$ is an initialization vector and $y_1^j=e_K(x_1^j \oplus > y_1^{j-1})$ for any $j>1$

The encryption for the rest of blocks $X_i = x_i^l...x_i^{l_i}$ is done as with $X_1$, but with the distinction that $y_0$ is chosen as being $y_{i-1}^{l_i - 1}$

(a) Show that if an intruder that has access to the blocks $Y_1$ and $X_2$, but not to $X_1$ can decide if a particular sub-block $x_1^j$ coincides or not with a message $x^*$ (of the same length) chosen by the intruder. (c) How can we improve the protocol to prevent the attack shown on (a).

This is just some random problem that I found in my book. I am interested in the solution for the point (a). I have tried to reverse engineer the algorithm given the fact that I know $X_2 = x_2^1...x_2^{l_2}$ and $Y_1$ I have everything I need in order to perform a decryption, but that seems to be wrong. How would you tackle this kind of problem?

$\endgroup$
  • 1
    $\begingroup$ This is not a 'custom' scheme, it is how SSL3 and TLS1.0 work (or worked) for a CBC ciphersuite, except for some obvious typos (presumably by you) and the omission of padding which isn't relevant for this issue. TLS1.1 fixes this flaw and its RFC cites openssl.org/~bodo/tls-cbc.txt (which now is https:) for the description of the attack. In this context 'access' means the attacker can see (the transmitted record containing) the ciphertext $Y_1$ and (adaptively) choose the next plaintext $X_2$; does that help? $\endgroup$ – dave_thompson_085 Feb 12 '18 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.