Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

XML Encryption is insecure: RUB Researchers break W3C standard

19.10.2011
XML Encryption is insecure: Large companies affected

Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. “Everything is insecure”, is the uncomfortable message from Bochum.

Standard for large integration projects

XML stands for “eXtensible Markup Language”, and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.

Weak chaining of ciphertext blocks

Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. “We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages.” The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure – in all cases the result was the same: the attack works, XML Encryption is not secure. Details of the attack are presented at this year’s ACM Conference on Computer and Communications Security (http://www.sigsac.org/ccs/CCS2011/techprogram.shtml).

No simple solution available

„There is no simple patch for this problem”, states Somorovsky. “We therefore propose to change the standard as soon as possible.” The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.

Further information

Prof. Dr. Jörg Schwenk, Faculty of Electrical Engineering and Information Sciences at the RUB, Chair for Network and Data Security, Tel. +49 234 32 26692

joerg.schwenk@rub.de

Dr. Josef König | idw
Further information:
http://www.ruhr-uni-bochum.de/
http://www.sigsac.org/ccs/CCS2011/techprogram.shtml

More articles from Information Technology:

nachricht Defining the backbone of future mobile internet access
21.07.2017 | IHP - Leibniz-Institut für innovative Mikroelektronik

nachricht Researchers create new technique for manipulating polarization of terahertz radiation
20.07.2017 | Brown University

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: Manipulating Electron Spins Without Loss of Information

Physicists have developed a new technique that uses electrical voltages to control the electron spin on a chip. The newly-developed method provides protection from spin decay, meaning that the contained information can be maintained and transmitted over comparatively large distances, as has been demonstrated by a team from the University of Basel’s Department of Physics and the Swiss Nanoscience Institute. The results have been published in Physical Review X.

For several years, researchers have been trying to use the spin of an electron to store and transmit information. The spin of each electron is always coupled...

Im Focus: The proton precisely weighted

What is the mass of a proton? Scientists from Germany and Japan successfully did an important step towards the most exact knowledge of this fundamental constant. By means of precision measurements on a single proton, they could improve the precision by a factor of three and also correct the existing value.

To determine the mass of a single proton still more accurate – a group of physicists led by Klaus Blaum and Sven Sturm of the Max Planck Institute for Nuclear...

Im Focus: On the way to a biological alternative

A bacterial enzyme enables reactions that open up alternatives to key industrial chemical processes

The research team of Prof. Dr. Oliver Einsle at the University of Freiburg's Institute of Biochemistry has long been exploring the functioning of nitrogenase....

Im Focus: The 1 trillion tonne iceberg

Larsen C Ice Shelf rift finally breaks through

A one trillion tonne iceberg - one of the biggest ever recorded -- has calved away from the Larsen C Ice Shelf in Antarctica, after a rift in the ice,...

Im Focus: Laser-cooled ions contribute to better understanding of friction

Physics supports biology: Researchers from PTB have developed a model system to investigate friction phenomena with atomic precision

Friction: what you want from car brakes, otherwise rather a nuisance. In any case, it is useful to know as precisely as possible how friction phenomena arise –...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

Event News

Closing the Sustainability Circle: Protection of Food with Biobased Materials

21.07.2017 | Event News

»We are bringing Additive Manufacturing to SMEs«

19.07.2017 | Event News

The technology with a feel for feelings

12.07.2017 | Event News

 
Latest News

NASA looks to solar eclipse to help understand Earth's energy system

21.07.2017 | Earth Sciences

Stanford researchers develop a new type of soft, growing robot

21.07.2017 | Power and Electrical Engineering

Vortex photons from electrons in circular motion

21.07.2017 | Physics and Astronomy

VideoLinks
B2B-VideoLinks
More VideoLinks >>>