crypto flaw in secure mail standards

Bill Frantz frantz at pwpconsult.com
Mon Jun 25 16:06:52 EDT 2001


At 10:32 AM -0700 6/24/01, Greg Broiles wrote:
>The attack raised - at least as it's been summarized, I haven't gotten
>around to the paper yet - sounds like a good one to remember, but too
>contrived to be especially dangerous in the real world today. How often do
>you, or people you know, send short context-free messages to conclude
>important negotiations? ...

I think Greg is probably right when it comes to email messages.  The places
that attacks like this worry me the most are in program-to-program
messages.  The "Cross-Site Request Forgeries" confused deputy attack
(http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html), described in
<http://archives.neohapsis.com/archives/bugtraq/2001-06/0170.html> and
<http://archives.neohapsis.com/archives/bugtraq/2001-06/0196.html>, seem a
place where two-way SSL cryptographic authentication can make a bad
situation worse, because more value is likely to be entrusted to the
communication.

In this attack, a user's browser is tricked into sending certain URLs which
exercise authority without the user's permission.  The specific URLs can be
hidden behind redirect requests, making it difficult to recognize that the
attack is taking place.

Cheers - Bill


-------------------------------------------------------------------------
Bill Frantz           | The principle effect of| Periwinkle -- Consulting
(408)356-8506         | DMCA/SDMI is to prevent| 16345 Englewood Ave.
frantz at pwpconsult.com | fair use.              | Los Gatos, CA 95032, USA





---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com




More information about the cryptography mailing list