How to Break XML Encryption Automatically Dennis Kupser, Christian - - PowerPoint PPT Presentation

▶
how to break xml encryption
SMART_READER_LITE
LIVE PREVIEW

How to Break XML Encryption Automatically Dennis Kupser, Christian - - PowerPoint PPT Presentation

Apr 06, 2023 578 likes •1.25k views

How to Break XML Encryption Automatically Dennis Kupser, Christian Mainka, Jrg Schwenk, Juraj Somorovsky Ruhr University Bochum @jurajsomorovsky 1 How to Break XML Encry rypt ption on Autom omati atical ally ly Juraj

slide-1
SLIDE 1

1

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

How to Break XML Encryption – Automatically

Dennis Kupser, Christian Mainka, Jörg Schwenk, Juraj Somorovsky

Ruhr University Bochum @jurajsomorovsky 1

slide-2
SLIDE 2

2

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

About Me and Our Institute

  • Security Researcher at:

– Chair for Network and Data Security

  • Prof. Dr. Jörg Schwenk
  • Web Services, Single Sign-On, (Applied) Crypto, SSL, crypto currencies
  • Provable security, attacks and defenses

– Horst Görtz Institute for IT-Security

  • Further topics: embedded security, malware, crypto…

– Ruhr University Bochum

  • Penetration tests, security analyses, workshops…

2

slide-3
SLIDE 3

3

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

3

slide-4
SLIDE 4

4

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

What is a (SOAP) Web Service?

Envelope getPrime Body Envelope Body 11 thePrime

Client Server

4

slide-5
SLIDE 5

5

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

5

More complicated scenarios …

Broker Bank Insurance XML XML XML Client

slide-6
SLIDE 6

6

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Security?

  • SSL / TLS: Transport-Level Security
  • Messages are only secured during transport

Broker Bank Insurance Client

6

slide-7
SLIDE 7

7

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Motivation – XML Security

  • Message Level Security
  • Messages protected directly
  • XML Security

Broker Bank Insurance Client

7

slide-8
SLIDE 8

8

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • Methods for cryptographic algorithms in XML
  • XML Signature: authenticity and integrity
  • XML Encryption: confidentiality
  • Flexible

8

XML Security

<PaymentInfo> <Name>John Smith</Name> <CreditCard Limit='5,000’> <Number>4019 ...5567</Number> <Issuer>Example Bank</Issuer> <Expiration>04/02</Expiration> </CreditCard> </PaymentInfo>

slide-9
SLIDE 9

10

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

XML Security Areas

  • Financial services:

– Electronic Banking Internet Communication (EBICS)

  • Healthcare:

– Australian eHealth Technical Specification

  • Governmental services:

– ID cards in Estonia, Germany, Hungary, …

  • System integration, firewalls

10

slide-10
SLIDE 10

12

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

12

slide-11
SLIDE 11

13

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Body MonitorInstances Id=”body” Timestamp Id=”Timestamp” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” URI=”#Timestamp” Reference DigestValue DigestValue

XML Signature

slide-12
SLIDE 12

14

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Header Security Signature SignedInfo Reference URI=”#body” SignValue Body MonitorInstances Id=”body” Id InstanceId Wrapper Envelope

McIntosh, Austel (2005) Bhargavan, Fournet, Gordon, O’Shea (2005)

Body MonitorInstances Id=”body” Id InstanceId Body CreateKeyPair Id=”attack” KeyName attackerKey

XML Signature Wrapping / Rewriting

slide-13
SLIDE 13

15

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

XML Signature Wrapping

Why does the attack work?

15

slide-14
SLIDE 14

16

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Header Security Signature SignedInfo Reference URI=”#body” KeyInfo Body MonitorInstances Id=”body” Id InstanceId Wrapper Envelope Body CreateKeyPair Id=”attack” KeyName attackerKey

XML Signature Wrapping

Server Verification logic Application logic

slide-15
SLIDE 15

17

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Cloud Controller

User

soap soap

  • Attacks on Amazon EC2 / Eucalyptus clouds
  • Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils

Gruschka, Luigi Lo Iacono: All Your Clouds Are Belong to Us – Security Analysis of Cloud Management Interfaces - CCSW 2011.

XML Signature Wrapping

17

slide-16
SLIDE 16

19

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

19

Further Attacks: SAML

Vladislav Mladenov, Christian Mainka, Florian Feldmann, Julian Krautwald, Jörg Schwenk: Your Software at my Service, CCSW 2014

XXE Signature Wrapping

slide-17
SLIDE 17

20

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

20

slide-18
SLIDE 18

22

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

22

XML Encryption

Body Envelope Header Security EncryptedKey EncryptionMethod CipherData Algorithm=”…#rsa-1_5” EncryptedData EncryptionMethod CipherData Algorithm=“…#aes128-cbc” ReferenceList DataReference URI=“#enc” Id=“enc”

1 2

Asymmetric encryption / decryption Symmetric encryption / decryption

Hybrid encryption scheme

slide-19
SLIDE 19

23

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Attacks on XML Encryption

  • Attacks on EncryptedKey

– Bleichenbacher’s Attack Strikes Again: Breaking PKCS#1 v1.5 in XML Encryption.

Tibor Jager, Sebastian Schinzel, Juraj Somorovsky. ESORICS 2012

  • Attacks on EncryptedData

– How to Break XML Encryption.

Tibor Jager, Juraj Somorovsky. CCS 2011

23

Body Envelope Header Security EncryptedKey EncryptedData URI=“#enc” Id=“enc”

Adaptive chosen-ciphertext attacks

slide-20
SLIDE 20

24

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

24

Adaptive chosen-ciphertext attack

Client XML Encryption ciphertext C = Enc(M) Chosen ciphertext C1 valid/invalid M = Dec(C) Web Service Chosen ciphertext C2 valid/invalid XML Encryption ciphertext C = Enc(M) … (repeated several times)

Server-Queries 14 / plaintext byte 400k to 82M / key Encryption symmetric asymmetric CCS 2011 ESORICS 2012

slide-21
SLIDE 21

25

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

25

slide-22
SLIDE 22

26

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

26

Attack Scenario

  • What is a “valid” plaintext?
  • How to use Web Service as “plaintext validity
  • racle”?
  • How to use this oracle to decrypt C?

XML Encryption ciphertext C = Enc(M) Chosen ciphertext C1 valid/invalid plaintext M = Dec(C) Web Service Chosen ciphertext C2 valid/invalid plaintext XML Encryption ciphertext C = Enc(M) … (repeated several times) Client

slide-23
SLIDE 23

27

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

27

slide-24
SLIDE 24

28

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Plaintext Validity

  • XML is a text-based data format
  • XML parsing
  • Characters (usually) encoded in ASCII

28

slide-25
SLIDE 25

29

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

29

ASCII

0x00 NUL 0x20 0x40 @ 0x60 ' 0x01 (Type A) 0x21 ! 0x41 A 0x61 a 0x02 (Type A) 0x22 " 0x42 B 0x62 b 0x03 (Type A) 0x23 # 0x43 C 0x63 c 0x04 (Type A) 0x24 $ 0x44 D 0x64 d 0x05 (Type A) 0x25 % 0x45 E 0x65 e 0x06 (Type A) 0x26 & 0x46 F 0x66 f 0x07 BEL 0x27 ' 0x47 G 0x67 g 0x08 BS 0x28 ( 0x48 H 0x68 h 0x09 HT 0x29 ) 0x49 I 0x69 i 0x0A LF 0x2A * 0x4A J 0x6A j 0x0B (Type A) 0x2B + 0x4B K 0x6B k 0x0C (Type A) 0x2C , 0x4C L 0x6C l 0x0D CR 0x2D

  • 0x4D

M 0x6D m 0x0E (Type A) 0x2E . 0x4E N 0x6E n 0x0F (Type A) 0x2F / 0x4F O 0x6F

  • 0x10

(Type A) 0x30 0x50 P 0x70 p 0x11 (Type A) 0x31 1 0x51 Q 0x71 q 0x12 (Type A) 0x32 2 0x52 R 0x72 r 0x13 (Type A) 0x33 3 0x53 S 0x73 s 0x14 (Type A) 0x34 4 0x54 T 0x74 t 0x15 (Type A) 0x35 5 0x55 U 0x75 u 0x16 (Type A) 0x36 6 0x56 V 0x76 v 0x17 (Type A) 0x37 7 0x57 W 0x77 w 0x18 (Type A) 0x38 8 0x58 X 0x78 x 0x19 (Type A) 0x39 9 0x59 Y 0x79 y 0x1A (Type A) 0x3A : 0x5A Z 0x7A z 0x1B ESC 0x3B ; 0x5B [ 0x7B { 0x1C (Type A) 0x3C < 0x5C \ 0x7C | 0x1D (Type A) 0x3D = 0x5D ] 0x7D } 0x1E (Type A) 0x3E > 0x5E ^ 0x7E ~ 0x1F (Type A) 0x3F ? 0x5F _ 0x7F DEL

Type A Type B

Not Parsable: Parsable:

„Valid“ Plaintext contains only Type B characters

slide-26
SLIDE 26

30

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

30

slide-27
SLIDE 27

31

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Validity Oracle

  • Using Web Services Server as plaintext validity
  • racle
  • Invalid plaintext => Parsing error
  • Parsing error => Fault message (or another side

channel)

31

Web Service XML Encryption ciphertext 1) Content Decryption 2) XML Parsing 3) XML Evaluation valid/invalid plaintext

slide-28
SLIDE 28

32

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

32

slide-29
SLIDE 29

33

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Consider ASCII character M1 = (0,b1,b2,b3,b4,b5,b6,b7)

0x00 NUL 0x20 0x40 @ 0x60 ' 0x01 (Type A) 0x21 ! 0x41 A 0x61 a 0x02 (Type A) 0x22 " 0x42 B 0x62 b 0x03 (Type A) 0x23 # 0x43 C 0x63 c 0x04 (Type A) 0x24 $ 0x44 D 0x64 d 0x05 (Type A) 0x25 % 0x45 E 0x65 e 0x06 (Type A) 0x26 & 0x46 F 0x66 f 0x07 BEL 0x27 ' 0x47 G 0x67 g 0x08 BS 0x28 ( 0x48 H 0x68 h 0x09 HT 0x29 ) 0x49 I 0x69 i 0x0A LF 0x2A * 0x4A J 0x6A j 0x0B (Type A) 0x2B + 0x4B K 0x6B k 0x0C (Type A) 0x2C , 0x4C L 0x6C l 0x0D CR 0x2D

  • 0x4D

M 0x6D m 0x0E (Type A) 0x2E . 0x4E N 0x6E n 0x0F (Type A) 0x2F / 0x4F O 0x6F

  • 0x10

(Type A) 0x30 0x50 P 0x70 p 0x11 (Type A) 0x31 1 0x51 Q 0x71 q 0x12 (Type A) 0x32 2 0x52 R 0x72 r 0x13 (Type A) 0x33 3 0x53 S 0x73 s 0x14 (Type A) 0x34 4 0x54 T 0x74 t 0x15 (Type A) 0x35 5 0x55 U 0x75 u 0x16 (Type A) 0x36 6 0x56 V 0x76 v 0x17 (Type A) 0x37 7 0x57 W 0x77 w 0x18 (Type A) 0x38 8 0x58 X 0x78 x 0x19 (Type A) 0x39 9 0x59 Y 0x79 y 0x1A (Type A) 0x3A : 0x5A Z 0x7A z 0x1B ESC 0x3B ; 0x5B [ 0x7B { 0x1C (Type A) 0x3C < 0x5C \ 0x7C | 0x1D (Type A) 0x3D = 0x5D ] 0x7D } 0x1E (Type A) 0x3E > 0x5E ^ 0x7E ~ 0x1F (Type A) 0x3F ? 0x5F _ 0x7F DEL

Type A Type B

33

slide-30
SLIDE 30

34

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Decrypting by checking plaintext validity

  • ASCII exhibits nice pattern of Type A/B

characters

  • Suppose we can flip arbitrary plaintext bits

and use a plaintext validity oracle

  • What could go wrong?

34

slide-31
SLIDE 31

35

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Decrypting by checking plaintext validity

  • Example
  • We have eavesdropped a ciphertext

C = Enc(“Deepsec”)

  • How to determine (b1,b2) of M1 = “D”?
slide-32
SLIDE 32

36

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Consider ASCII character M1 = (0,b1,b2,b3,b4,b5,b6,b7)

0x00 NUL 0x20 0x40 @ 0x60 ' 0x01 (Type A) 0x21 ! 0x41 A 0x61 a 0x02 (Type A) 0x22 " 0x42 B 0x62 b 0x03 (Type A) 0x23 # 0x43 C 0x63 c 0x04 (Type A) 0x24 $ 0x44 D 0x64 d 0x05 (Type A) 0x25 % 0x45 E 0x65 e 0x06 (Type A) 0x26 & 0x46 F 0x66 f 0x07 BEL 0x27 ' 0x47 G 0x67 g 0x08 BS 0x28 ( 0x48 H 0x68 h 0x09 HT 0x29 ) 0x49 I 0x69 i 0x0A LF 0x2A * 0x4A J 0x6A j 0x0B (Type A) 0x2B + 0x4B K 0x6B k 0x0C (Type A) 0x2C , 0x4C L 0x6C l 0x0D CR 0x2D

  • 0x4D

M 0x6D m 0x0E (Type A) 0x2E . 0x4E N 0x6E n 0x0F (Type A) 0x2F / 0x4F O 0x6F

  • 0x10

(Type A) 0x30 0x50 P 0x70 p 0x11 (Type A) 0x31 1 0x51 Q 0x71 q 0x12 (Type A) 0x32 2 0x52 R 0x72 r 0x13 (Type A) 0x33 3 0x53 S 0x73 s 0x14 (Type A) 0x34 4 0x54 T 0x74 t 0x15 (Type A) 0x35 5 0x55 U 0x75 u 0x16 (Type A) 0x36 6 0x56 V 0x76 v 0x17 (Type A) 0x37 7 0x57 W 0x77 w 0x18 (Type A) 0x38 8 0x58 X 0x78 x 0x19 (Type A) 0x39 9 0x59 Y 0x79 y 0x1A (Type A) 0x3A : 0x5A Z 0x7A z 0x1B ESC 0x3B ; 0x5B [ 0x7B { 0x1C (Type A) 0x3C < 0x5C \ 0x7C | 0x1D (Type A) 0x3D = 0x5D ] 0x7D } 0x1E (Type A) 0x3E > 0x5E ^ 0x7E ~ 0x1F (Type A) 0x3F ? 0x5F _ 0x7F DEL

Type A Type B

36 36

slide-33
SLIDE 33

37

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Consider ASCII character M1 = (0,b1,b2,b3,b4,b5,b6,b7)

0x00 NUL 0x20 0x40 @ 0x60 ' 0x01 (Type A) 0x21 ! 0x41 A 0x61 a 0x02 (Type A) 0x22 " 0x42 B 0x62 b 0x03 (Type A) 0x23 # 0x43 C 0x63 c 0x04 (Type A) 0x24 $ 0x44 D 0x64 d 0x05 (Type A) 0x25 % 0x45 E 0x65 e 0x06 (Type A) 0x26 & 0x46 F 0x66 f 0x07 BEL 0x27 ' 0x47 G 0x67 g 0x08 BS 0x28 ( 0x48 H 0x68 h 0x09 HT 0x29 ) 0x49 I 0x69 i 0x0A LF 0x2A * 0x4A J 0x6A j 0x0B (Type A) 0x2B + 0x4B K 0x6B k 0x0C (Type A) 0x2C , 0x4C L 0x6C l 0x0D CR 0x2D

  • 0x4D

M 0x6D m 0x0E (Type A) 0x2E . 0x4E N 0x6E n 0x0F (Type A) 0x2F / 0x4F O 0x6F

  • 0x10

(Type A) 0x30 0x50 P 0x70 p 0x11 (Type A) 0x31 1 0x51 Q 0x71 q 0x12 (Type A) 0x32 2 0x52 R 0x72 r 0x13 (Type A) 0x33 3 0x53 S 0x73 s 0x14 (Type A) 0x34 4 0x54 T 0x74 t 0x15 (Type A) 0x35 5 0x55 U 0x75 u 0x16 (Type A) 0x36 6 0x56 V 0x76 v 0x17 (Type A) 0x37 7 0x57 W 0x77 w 0x18 (Type A) 0x38 8 0x58 X 0x78 x 0x19 (Type A) 0x39 9 0x59 Y 0x79 y 0x1A (Type A) 0x3A : 0x5A Z 0x7A z 0x1B ESC 0x3B ; 0x5B [ 0x7B { 0x1C (Type A) 0x3C < 0x5C \ 0x7C | 0x1D (Type A) 0x3D = 0x5D ] 0x7D } 0x1E (Type A) 0x3E > 0x5E ^ 0x7E ~ 0x1F (Type A) 0x3F ? 0x5F _ 0x7F DEL

Type A Type B

37 37

slide-34
SLIDE 34

38

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Performance

  • 14 queries / byte

38

slide-35
SLIDE 35

39

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

39

Why Flipping Possible?

slide-36
SLIDE 36

40

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Cipher Block Chaining Mode

  • Flip arbitrary bits in plaintext
  • Applied in padding oracle attacks

40

Initialization Vector (IV)

...

Ciphertext Block 1

AES Key Ciphertext: Plaintext:

CBC decryption

slide-37
SLIDE 37

41

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

41

slide-38
SLIDE 38

42

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Basic Idea

  • Protect integrity and authenticity of

ciphertexts

  • Not easy…

42

slide-39
SLIDE 39

44

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

44

XML Signature Wrapping?

Body Id=”attacked” Envelope Header Security Signature Reference URI=”#body” EncryptedKey DataReference URI=“#oracle” EncryptedData Id=“oracle” CipherData Body Id=”body” EncryptedData Id=“enc” CipherData

Signature validation Decryption

Body Id=”body” EncryptedData Id=“enc” CipherData

slide-40
SLIDE 40

45

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

45

XML Encryption Wrapping?

Body Id=”body” Envelope Header Security Signature Reference URI=”#body” EncryptedKey DataReference URI=“#enc” EncryptedData Id=“enc” CipherData EncryptedData Id=“oracle” CipherData EncryptedKey DataReference URI=“#oracle”

Signature validation Decryption Business logic Decryption and

slide-41
SLIDE 41

46

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

How to analyze Web Services Automatically?

slide-42
SLIDE 42

47

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

  • 1. What is a Web Service and XML Security
  • 2. XML Signature Wrapping
  • 3. Attacks on XML Encryption
  • 4. Attacks on Symmetric Encryption Scheme
  • 1. Attack Scenario
  • 2. Plaintext Validity
  • 3. Using Web Service for Plaintext Validation
  • 4. Decrypting by Checking Plaintext Validity
  • 5. Countermeasures and Problems
  • 6. WS-Attacker

Overview

47

slide-43
SLIDE 43

48

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

WS-Attacker

48

  • Automatic penetration test tool for Web Services
  • https://github.com/RUB-NDS/WS-Attacker
  • Supports many attacks

– New plugin for XML Encryption

  • Approach:
  • 1. Analyze message security
  • 2. Remove signature protection
  • 3. Attack (symmetric / asymmetric)
slide-44
SLIDE 44

49

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase Avoid Phase Attack Phase

49

Automated Attack Workflow

Identify Security Elements

Encrypted XML

slide-45
SLIDE 45

50

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase (Offline)

Body Envelope Header Security EncryptedKey EncryptedData URI=“#a” Id=“a” Signature URI=“#b” Signature URI=“#c” Timestamp Id=“c” Id=“b”

50

slide-46
SLIDE 46

51

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase Avoid Phase Attack Phase

51

Automated Attack Workflow

Knowledge Pool Identify Security Elements Signed Timestamp?

Encrypted XML

slide-47
SLIDE 47

52

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase (Offline)

Body Envelope Header Security EncryptedKey EncryptedData URI=“#a” Id=“a” Signature URI=“#b” Signature URI=“#c” Timestamp Id=“c” Id=“b”

52

slide-48
SLIDE 48

53

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase Avoid Phase Attack Phase

53

Automated Attack Workflow

Knowledge Pool Identify Security Elements Signed Timestamp? XSW

no yes Encrypted XML

slide-49
SLIDE 49

54

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

No Attribute Position 1

Applying XSW - Complexity

54

Body getServerTime Id=”body” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body”

getAdminConfig Id=“atk”

Body getServerTime Id=”body” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body”

getAdminConfig Id=“atk”

Body getServerTime Id=”body” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body”

getAdminConfig Id=“atk”

Body getServerTime Id=”body” SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body”

getAdminConfig Id=“body”

Body getServerTime SignatureValue Envelope Header Security Signature SignedInfo Reference URI=”#body” DigestValue KeyInfo Body getServerTime Id=”body”

getAdminConfig

slide-50
SLIDE 50

55

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase Avoid Phase Detection Phase

55

Automated Attack Workflow

Knowledge Pool Identify Security Elements Signed Timestamp? XSW Signed Encrypted Element XSW XEW

no no yes yes fail fail

Identify Oracle

yes no Encrypted XML

slide-51
SLIDE 51

56

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Web Service

Identify Oracle

  • Map Server Responses to „valid“ or „invalid“
  • Implementation dependent!

56

XML Encryption ciphertext C = Enc(M) Chosen ciphertext <ok/> Chosen ciphertext <failure/>

slide-52
SLIDE 52

57

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Detection Phase Avoid Phase Attack Phase

57

Automated Attack Workflow

Knowledge Pool Identify Security Elements Signed Timestamp? XSW Signed Encrypted Element XSW XEW Identify Oracle Apply Attack

no no yes yes fail fail Decrypted XML yes no yes fail Encrypted XML

slide-53
SLIDE 53

58

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Results

System Asymmetric Attack Symmetric Attack Countermeasures applicable? Apache Axis2 1.6.2 Apache CXF 2.7.10 yes Axway Gateway 7.3.1 yes IBM Datapower XI50 yes Microsoft WCF yes 58

     

slide-54
SLIDE 54

59

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Load WSDL

59

slide-55
SLIDE 55

60

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Send Test Request

60

slide-56
SLIDE 56

61

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Choose Attacks

61

slide-57
SLIDE 57

62

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Configure XML Encryption

slide-58
SLIDE 58

63

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Start Attack

63

slide-59
SLIDE 59

64

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

64

Case Apache CXF

Body Envelope Header Security EncryptedKey EncryptionMethod CipherData #rsa-1_5 EncryptedData EncryptionMethod CipherData #aes128-cbc

1 2

Asymmetric decryption Symmetric decryption

CVE-2015-0226 CVE-2015-0227 k

slide-60
SLIDE 60

65

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

65

Case Apache CXF: Symmetric

Body Envelope Header Security EncryptedKey EncryptionMethod CipherData #rsa-1_5 EncryptedData EncryptionMethod CipherData #aes128-cbc

2

Symmetric decryption

CVE-2015-0226 CVE-2015-0227

Signature enforced with:

requireSignedEncryptedDataElements = "true"

Signature Wrapping

slide-61
SLIDE 61

66

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

66

Case Apache CXF: Asymmetric

Body Envelope Header Security EncryptedKey EncryptionMethod CipherData #rsa-1_5 EncryptedData EncryptionMethod CipherData #aes128-cbc

1 2

Asymmetric decryption Symmetric decryption

CVE-2015-0226 CVE-2015-0227 k Side Channel

slide-62
SLIDE 62

67

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

67

Case Apache CXF: Asymmetric

Body Envelope Header Security EncryptedKey EncryptionMethod CipherData #rsa-1_5 EncryptedData EncryptionMethod CipherData #aes128-cbc

1

Asymmetric decryption

CVE-2015-0226 CVE-2015-0227 k random (128 bits) 128 bytes Invalid countermeasure

slide-63
SLIDE 63

68

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Playing with WS-Attacker

  • https://github.com/RUB-NDS/WS-Attacker
  • Use Apache Axis2 and Apache Rampart
  • Examples:

– http://web-in-security.blogspot.de/

68

slide-64
SLIDE 64

69

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Countermeasures

  • AES-CBC, RSA-PKCS#1 v1.5 insecure!
  • XML Encryption updated (Version 1.1)
  • AES-GCM added
  • Use of secure algorithms: RSA-OAEP, AES-GCM
  • If secure algorithms not available, only decrypt

signed XML ciphertexts

  • Example: IBM Datapower
slide-65
SLIDE 65

71

How to Break XML Encry rypt ption

  • n – Autom
  • mati

atical ally ly Juraj Somorovsky

Conclusion

  • XML – especially XML Security – is complex
  • WS-Attacker for evaluation:

– https://github.com/RUB-NDS/WS-Attacker

  • Our approach applicable to other scenarios

– SAML, JSON, Web Crypto…

  • Prefer authenticated encryption (AES-GCM

instead of AES-CBC)

71