How to break XML encryption

ABSTRACT

XML Encryption was standardized by W3C in 2002, and is implemented in XML frameworks of major commercial and open-source organizations like Apache, redhat, IBM, and Microsoft. It is employed in a large number of major web-based applications, ranging from business communications, e-commerce, and financial services over healthcare applications to governmental and military infrastructures. In this work we describe a practical attack on XML Encryption, which allows to decrypt a ciphertext by sending related ciphertexts to a Web Service and evaluating the server response. We show that an adversary can decrypt a ciphertext by performing only 14 requests per plaintext byte on average. This poses a serious and truly practical security threat on all currently used implementations of XML Encryption.

In a sense the attack can be seen as a generalization of padding oracle attacks (Vaudenay, Eurocrypt 2002). It exploits a subtle correlation between the block cipher mode of operation, the character encoding of encrypted text, and the response behaviour of a Web Service if an XML message cannot be parsed correctly.

References

1. Black, J., and Urtubia, H. Side-channel attacks on symmetric encryption schemes: The case for authenticated encryption. In USENIX Security Symposium (2002), D. Boneh, Ed., USENIX, pp. 327--338.
2. Bray, T., Paoli, J., Sperberg-McQueen, C. M., Maler, E., and Yergeau, F. Extensible Markup Language (XML) 1.0 (Fifth Edition). W3C Recommendation (2008).
3. Degabriele, J. P., and Paterson, K. G. Attacking the IPsec standards in encryption-only configurations. In IEEE Symposium on Security and Privacy (2007), IEEE Computer Society, pp. 335--349.
4. Degabriele, J. P., and Paterson, K. G. On the (in)security of IPsec in MAC-then-encrypt configurations. In ACM Conference on Computer and Communications Security (2010), E. Al-Shaer, A. D. Keromytis, and V. Shmatikov, Eds., ACM, pp. 493--504.
5. Duong, T., and Rizzo, J. Cryptography in the web: The case of cryptographic design flaws in ASP.NET. In IEEE Symposium on Security and Privacy (2011).
6. Eastlake, D., Reagle, J., Imamura, T., Dillaway, B., and Simon, E. XML Encryption Syntax and Processing. W3C Recommendation (2002).
7. Eastlake, D., Reagle, J., Solo, D., Hirsch, F., and Roessler, T. XML Signature Syntax and Processing (Second Edition). W3C Recommendation (2008).
8. Gudgin, M., Hadley, M., Mendelsohn, N., Moreau, J.-J., and Nielsen, H. F. SOAP Version 1.2 Part 1: Messaging Framework. W3C Recommendation (2003).
9. JBoss Community. JBoss WS (Web Services Framework for JBoss AS).
10. McIntosh, M., and Austel, P. XML signature element wrapping attacks and countermeasures. In SWS '05: Proceedings of the 2005 workshop on Secure web services (New York, NY, USA, 2005), ACM Press, pp. 20--27.
11. Mitchell, C. J. Error oracle attacks on cbc mode: Is there a future for cbc mode encryption? In ISC (2005), pp. 244--258.
12. Nadalin, A., Kaler, C., Monzillo, R., and Hallam-Baker, P. Web Services Security: SOAP Message Security 1.1 (WS-Security 2004). OASIS Standard (2006).
13. Paterson, K. G., and Watson, G. J. Immunising CBC mode against padding oracle attacks: A formal security treatment. In SCN (2008), R. Ostrovsky, R. D. Prisco, and I. Visconti, Eds., vol. 5229 of Lecture Notes in Computer Science, Springer, pp. 340--357.
14. Paterson, K. G., and Yau, A. Padding oracle attacks on the ISO CBC mode encryption standard. In Topics in Cryptology -- CT-RSA 2004 (Feb. 2004), T. Okamoto, Ed., vol. 2964 of Lecture Notes in Computer Science, Springer, pp. 305--323.
15. Rizzo, J., and Duong, T. Practical padding oracle attacks. In Proceedings of the 4th USENIX conference on Offensive technologies (Berkeley, CA, USA, 2010), WOOT'10, USENIX Association, pp. 1--8.
16. Robert A. van Engelen. The gSOAP Toolkit for SOAP Web Services and XML-Based Applications.
17. Thai, T., and Lam, H. .NET Framework Essentials. 2001.
18. The Apache Software Foundation. Apache Axis2.
19. Vaudenay, S. Security flaws induced by CBC padding - applications to SSL, IPSEC, WTLS ... In Advances in Cryptology -- EUROCRYPT 2002 (Apr. / May 2002), L. R. Knudsen, Ed., vol. 2332 of Lecture Notes in Computer Science, Springer, pp. 534--546.
20. Yau, A. K. L., Paterson, K. G., and Mitchell, C. J. Padding oracle attacks on CBC-mode encryption with secret and random IVs. In Fast Software Encryption -- FSE 2005 (Feb. 2005), H. Gilbert and H. Handschuh, Eds., vol. 3557 of Lecture Notes in Computer Science, Springer, pp. 299--319.

Index Terms

• Security and privacy

  • Cryptography

    • Cryptanalysis and other attacks

• Social and professional topics

  • Computing / technology policy

    • Computer crime