Crypto

Because not all crypto is TLS.

"LuckyMinus20": Yet Another Padding Oracle in OpenSSL CBC Cipher Suites

Early this week, a new OpenSSL error code padding oracle dropped. Padding oracles are one of the most fun crypto vulnerabilities, so I gave this one the full treatment: a ten lines PoC and CLI test, obviously based on a patched Go crypto/tls https://github.com/FiloSottile/CVE-2016-2107 an…

Bleichenbacher'06 signature forgery in python-rsa

While looking at the source of python-rsa (>100K daily downloads) I found it vulnerable to a straightforward variant of the Bleichenbacher'06 attack against RSA signature verification with low public exponent. The bug allows us to forge signatures for arbitrary messages, as long as the public key has a low…

Logjam explained

Logjam is a downgrade attack against the TLS protocol itself which exploits EXPORT ciphersuites. I wrote a long explanation of how the attack works and its background (what Diffie-Hellman is and how exactly it's used in the TLS handshake) on the CloudFlare blog. Logjam: the latest TLS vulnerability explained | CloudFlare…

scrypt all the things!

If you take away only one thing from this post let it be this: **If you have a human password, ==scrypt it==.** [^1] The reason passwords suck is because humans are terrible at generating and storing entropy. (That and password reuse, but that's another story.) And the reason that's a…

Salt & Pepper, please: a note on password storage

Everyone will tell you that the best practice for password storage is [sb]crypt with random salt. Ok, we got that and even maybe got everyone to agree. But let me bump that up a notch: do you know what pepper is? The concept of peppering is simple: add a…