Score:3

how 0/n split prevent BEAST attack against TLS?

il flag

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? what the diffrence between normal TLS? the attacker can still xor the block he want to guess with the last block to disable the iv affect.

Score:3
my flag

Well, in TLS 1.0 and a CBC mode ciphersuite, the IV for the next record would always be the last ciphertext block for the previous record. That is, the first encrypted block of each record would be:

$$C_0 = Encrypt_k( P_0 \oplus C_{prev} )$$

What the BEAST attack did was exploit this to generate an encryption Oracle. If they had a guess that a plaintext block (xored with its previous ciphertext block) generated a specific ciphertext block, what they would do is take the current last ciphertext block $C_{prev}$, and have the device generate a plaintext block $P_0$ such that, the two xor'ed together would be the plaintext block (xor'ed with its previous ciphertext block) under test - if the resulting first ciphertext block of the record was what they expect, their guess was correct (and the rest of the exploit was using this Oracle to extract useful information).

Now, if you read through the above text, we see that this attack needs the previous ciphertext block immediately before we encrypt the plaintext, and the attacker needs to see that before he picks his $P_0$ plaintext block. In TLS 1.1, the IV is generated unpredictably by the sender, thus preventing this attack.

If we live with TLS 1.0, we can't change the protocol, but we can emulate it. What this defense does is generate an empty block; the resulting ciphertext is an encryption of data that the attacker cannot control (hence he cannot use that to perform the BEAST attack). And, that ciphertext has a last block that the attacker cannot predict, hence preventing him knowledge of the $C_{prev}$ that will be used when he generates $P_0$, hence effectively emulating the 'use an unpredictable IV' defense in TLS 1.1.

Historic note: TLS 1.1 predated the BEAST attack, but was specifically designed to foil this 'encryption oracle' facet of BEAST. The real innovation of BEAST was the part that used this oracle to perform real world attack.

eitan avatar
il flag
I dont understand why "the resulting ciphertext is an encryption of data that the attacker cannot control" when you generate an enpry block? i can't take the empty block ciphertext and xor it with my guess like the beast attack? i guess i miss something but i don't find it:(
poncho avatar
my flag
@eitan: Actually, it's safe. When you encrypt a record (empty or not), what you actually encrypt is "record || HMAC || padding". The empty record and padding is predictable; the HMAC is not. Hence, the first data presented to the block cipher for an empty record is completely unpredictable, and hence is useless to BEAST
eitan avatar
il flag
Thenk you very much! why with empty record HMAC is not predictable? how BEAST predict HMAC?
poncho avatar
my flag
@eitan: the HMAC is unpredictable because the HMAC key is unknown to the attacker, and it is on data (such as the record count) that changes for every record (and hence the HMAC will change from record to record).
poncho avatar
my flag
@eitan: with the normal BEAST attack (against unprotected TLS 1.0) the attacker has no need to predict the HMAC - all he needs is the last ciphertext block (which he sees) and can control the next plaintext block. He doesn't really care what that last ciphertext block is an encryption of.
eitan avatar
il flag
you said that "He doesn't really care what that last ciphertext block is an encryption of" so i don't understand why it matter if it encryption of empty record, he can also see the last ciphertext block with empty record. you can still disable the IV affect like normal BEAST do.
poncho avatar
my flag
@eitan: yes, but he needs to specify $P_0$ **before** he sees that ciphertext block, hence he can't pick $P_0$ to xor with that ciphertext block to generate the block cipher input he wants to test
eitan avatar
il flag
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/148193/discussion-between-eitan-and-poncho).
Maarten Bodewes avatar
in flag
poncho, I can do three things: 1. leave the comments & chat as is (default), 2. remove the comments & chat or 3. wait for you to bring in some of the explanation in the comments into the already fine answer and then do a cleanup. Any preference?
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.