Zimmermann Enters Debate on Microsoft Encryption 381
Golygydd Max writes "I didn't see much coverage of the RC4 flaw in Microsoft Office that was uncovered recently by a researcher, Hongjun Wu. Now, PGP creator Phil Zimmermann, dissatisfied with Microsoft's response, has joined in the debate. In an interview with Techworld he castigates Microsoft for their inadequate response: 'The lay user ought to be entitled to assume that the encryption produced by Microsoft is adequate. ... If Microsoft wants to earn the respect of the cryptographic community and the public it must rise to the occasion by producing competent security.' The cynic might ask, 'what respect', but should Microsoft have taken a flaw in some of its most popular programs more seriously?"
First rule of Microsoft encryption (Score:4, Insightful)
Re:First rule of Microsoft encryption (Score:2)
Couldn't you extend the rule from simply "Microsoft encryption" to the more general "Microsoft Security"?
Re:First rule of Microsoft encryption (Score:2)
Stick to stuff like 3DES, and AES, and I think you'll be fine. But don't listen to me - I'm no cryptographer.
Re:First rule of Microsoft encryption (Score:4, Informative)
Also, it is a little misleading to say it was "open sourced" against its will. Firstly, because it wasn't "open sourced" in the strictest sense but more importantly, RC4 is just an algorithm with many different implementations and an algorithmic description is information. And as we all know, information wants to be freeee.
Re:First rule of Microsoft encryption (Score:2, Funny)
Re:First rule of Microsoft encryption (Score:5, Interesting)
Consider NSA's track record:
An agreement with Microsoft to ensure insecure encryption would be very out of character for them.
That is, unless they're just a bunch of Linux freaks.
Re:First rule of Microsoft encryption (Score:2)
* In the seventies they recommended changes to DES, which in the early ninties were discovered to have made it more secure.
* They have developed and are freely distributing the source for an improved-security version of Linux.
Well also consider things like the idea of a federally-controlled encryption scheme where the government held a key escrow so they could decrypt any traffic for national security purposes. Ultimately nobody wanted to buy into it but they did
Re:First rule of Microsoft encryption (Score:2)
I don't consider this bug a humongous issue for the vast population. Really, in order to exploit the bug you need single character change (no additional or fewer) in order to jimmy the key schedule.
And you need to leave multiple copies laying around for people to snatch up.
The "solution" they propose is no solution anyway!! We're got to go protect a database of IV's for EVERY document created, AND wrap all the protocols, provide authentica
copyright (Score:4, Insightful)
Re:copyright (Score:5, Funny)
Re:copyright (Score:2)
Uhhh... Public... Domain?
Re:copyright (Score:3, Insightful)
>>How else are we supposed to get access to all these works in 150
>>years time (or 50 in some countries) when the copyright expires on them.
>Uhhh... Public... Domain?
If the encryption were unbreakable and the keys lost, it would not be a lot of use
Re:copyright (Score:2)
Re:copyright (Score:2)
Yes, but it's the one-time pad. If you're asking is asymmetric encryption theoretically unbreakable, no. As long as there are a finite amount of keys to try, you can just keep trying them all. How long it takes is the question.
Re:copyright (Score:3, Insightful)
The basic concept is to take a completely random stream of characters (numbers, bits, whatever). You record these random characters to a pad, and distribute this pad to everyone who needs to send and decrypt messages.
When you want to send a message, you XOR your message with the random characters. The result is a completely random string of characters. To decrypt, you XOR the encrypted message with the same random ch
Re:copyright (Score:2)
Is unbreakable encryption even theoretically possible?
I would say not.
It's really a matter of definition more than anything else. Encrypting something is generally assumed to mean turning it into something which is unrecognisable as the original, but which can be converted back (decrypted).
If there is a way of converting it back, it must be theoretically possible to find out how, thus it is breakable. Of course, it might be so difficult or take so long that it was unfeasable. That would make the enc
Re:copyright (Score:5, Insightful)
Re:copyright (Score:2, Insightful)
I bet there was a time when there was a powerful horse breeders lobby.
Re:copyright (Score:2)
Re:copyright (Score:4, Insightful)
Re:copyright (Score:2)
That's of course assuming nobody finds a faster way than brute force.
Re:copyright (Score:2, Insightful)
What you were trying to sya that it's improbable, not impossible, that you'll be able to break 128-bit encryption anytime soon. You just have to try long enough, but who wants to wait a century to brute-force a single key?
Of course, the attacker could be lucky, and the very first key
Re:copyright (Score:3, Informative)
might encrypt as
but can also decipher, equally plausibly, as
or even
Additionall
Employ Mr. Zimmerman (Score:5, Interesting)
The fact that so many documents written (especially now) are using Microsoft formats, makes this problem very dangerous.
Its worth mentioning that any docuemtns that are actually worth protecting should by default not rely on Micrsofts (lack of) security, as it is a known trend that Microsoft fails time and time again to provide adaquate security.
People think "wow! encryption, and NOT a lame password". By as per normal, scratch a little deeper and you can see how flawed microsoft code actually is...
Re:Employ Mr. Zimmerman (Score:2)
Have to say it.... (Score:5, Funny)
Re:Have to say it.... (Score:4, Funny)
"Hanging is too good for a punster. He should be drawn and quoted."
MS Encryption is a joke (Score:5, Informative)
How is this done? Every file that is written to an encrypted folder by User A has a private encryption key generated for it. That private encryption key is then encrypted with User A's public key and every designed Encrypted Data Recovery Agent's public key. Then either User A or any such recovery agent's private key can then decrypt the file.
Of course, MS just lets lay users assume their "encrypted" files are private.
Re:MS Encryption is a joke (Score:5, Insightful)
For corporations (the target market for EFS), it means that if someone is fired, quits, dies, etc. then their data is not lost foreever.
Re:MS Encryption is a joke (Score:2, Insightful)
Re:MS Encryption is a joke (Score:2)
For corporations (the target market for EFS), it means that if someone is fired, quits, dies, etc. then their data is not lost foreever.
This is yet another solved problem. OS X allows encrypted user partitions and encrypted disk images. It allows an administrative key to user partitions as an option. It warns everyone what is going on when the features are enabled. This is just not that hard. MS did not quite get it right, they need to copy Apple more closely.
Re:MS Encryption is a joke (Score:2, Insightful)
I'm sorry, but if I'm on my death bed and I am not senile, then there is a reason why I have not decrypted my files - because I don't want them opened.
If you're puting personal encrypted material on your employer's computer, then you are already senile.
Re:MS Encryption is a joke (Score:4, Insightful)
Comment removed (Score:5, Insightful)
Re:MS Encryption is a joke (Score:2)
Or move it to removable storage.
Re:MS Encryption is a joke (Score:2)
You obviously don't deal with typical users. They are the biggest pack rats. This is why disk quotas were created to force them to offload data elsewhere.
Re:MS Encryption is a joke (Score:2)
A spiteful (ex)-employee could easily encrypt and forever destroy sensitive data that is irreplaceable.
Or they could just overwrite it and delete it.
typical user to permanently encrypt data that can never be revealed
Not sure why you'd want to "permanently encrypt data"... You might as well overwrite and delete it.
Re:MS Encryption is a joke (Score:5, Insightful)
Such as, exactly?
"AI spiteful (ex)-employee could easily encrypt and forever destroy sensitive data that is irreplaceable."
Or they could just del *.*. Or format c:. Or burn down the building.
This whole 'spiteful employee' argument is nonsense. The only reasons to have a 'key recovery agent' are to recover password for clueless employees and to spy on slightly more clued employees.
Re:MS Encryption is a joke (Score:5, Insightful)
While I agree that the 'spiteful employee' arguement is largely bunk, the 'employee who quit, got fired, or otherwise left unexpectedly' arguement is not.
e.g. I am a sysadmin, and I store all the incident reports on a Win2k3 EFS box, encrypted to my key. These incident reports are important to whomever is doing my job -- no one needs to see them unless I leave unexpectedly. If I get trampled by a herd of malicious gnus on the way to work, the top-level admins will need access to my data, as will whoever replaces me.
There are two solutions to that -- share my key or use the EFS recoverable key system. Guess which I'd rather do?
Re:MS Encryption is a joke (Score:2)
What on earth are you talking about? All of this applies only to machines in a domain - ie it doesn't apply to the vast majority of home users (who will have a workgroup if anything)
Re:MS Encryption is a joke (Score:2)
Re:MS Encryption is a joke (Score:2)
For Microsoft false security sells, and true security doesn't. So of course they shell out products with "backdoors".
Now, the RC4 implementation is not one of those, but just a plain bug.
Re:MS Encryption is a joke (Score:2)
As an administrator, if I have an employee leave disgruntled, and the boss asks me to find out why, am I to tell him/her "he encrypted his files, therefore he has full privacy". No, he doesn't. It's our machine. If he wants full privacy, he should encrypt files on hi
Don't Worry (Score:5, Funny)
Why fix it in a free patch, when they can charge money for a new version that you have a reason to buy?
Re:Don't Worry (Score:2)
Re:Don't Worry (Score:2)
Yep. Windows 2003!! Not as good as the next version!
Article mirror (Score:3, Informative)
Microsoft should sort flaw and abandon RC4 in favour of better ciphers, says PGP creator.
By John E. Dunn, Techworld
Cryptography expert Phil Zimmermann has said he believes the flaw discovered in Microsoft's Word and Excel encryption is serious and warrants immediate attention.
"I think this is a serious flaw - it is highly exploitable. It is not a theoretical attack," said Zimmermann, referring to a flaw in Microsoft's use of RC4 document encryption unearthed recently by a researcher in Singapore.
"The lay user ought to be entitled to assume that the encryption produced by Microsoft is adequate. [...] If Microsoft wants to earn the respect of the cryptographic community and the public it must rise to the occasion by producing competent security."
Microsoft has been dismissive of the seriousness of the flaw, which relates to the way it has implemented the RC4 encryption stream cipher. As explained by Hungjun Wu of the Institute of Infocomm Research, it would allow anyone able to gain access to two or more versions of the same password and encrypted document to reverse engineer the scheme used to make it secure.
"Stream ciphers have to be used most carefully. Any failure to do this will result in a disastrous loss of security," Zimmermann said. "Even with a properly chosen initialisation vector, you have to run it for a while before the quality of the stream cipher is good enough to use." Contrary to Microsoft's claims that the issue was a "very low threat", he countered that gaining access to a document would not present problems for a determined hacker. "There are tools one can use to cryptanalyse messages in this way."
Even if the flaw was fixed, in his view a more fundamental problem was Microsoft's use of RC4, licensed from RSA Security.
"Why does Microsoft continue to use RC4 in this day and age? It has other security flaws that have been published in other papers," adding that "RC4 is a proprietary cipher and has not stood up well to peer review. They should just stop using RC4. It would be better to switch to a block cipher."
When contacted Microsoft, was unable to commit to a timescale for correcting the flaw but issued the following statement by way of a spokesperson: "Microsoft is still investigating this report of a possible vulnerability in Microsoft Office. When that investigation is complete, we will take the appropriate actions to protect customers. This may include providing a security update through our monthly release process."
Zimmermann, meanwhile, emphasised the need for responsible disclosure of such problems. "The best way is to quietly disclose the problem to the vendor and then allow the vendor 30 days to fix the problem. Then go public," he said.
Phil Zimmermann is best-known as the creator of Pretty Good Privacy (PGP), a desktop encryption program that was powerful enough that the US authorities attempted to have its distribution stopped and Zimmermann imprisoned for writing it. The case was abandoned 1996. PGP was bought out by Network Associates, though an independent company, PGP Corporation, has since been spun out to develop its core technology.
Re:Article mirror (Score:2)
The same reason they're still using the tired old method of 3 letter file extension to mark file types - backwards compatability. BC is what made windows and MSs bank balance what it is , for good AND bad.
Comment removed (Score:5, Insightful)
Cheaper alternative... (Score:2)
Bah.... (Score:3, Funny)
Re:Bah.... (Score:3, Funny)
Maybe Deliberate? (Score:2)
Jolyon
Re:Maybe Deliberate? (Score:2)
Re:Maybe Deliberate? (Score:2)
Jolyon (5 letter surname)
Re:Maybe Deliberate? (Score:2)
Jolyon
I wonder when... (Score:5, Interesting)
Good enough (Score:3, Informative)
Total bull, but that's why they haven't change anything in IE for so many years.
Re:Good enough (Score:2)
If it doesn't interfere with revenue, it's not a bug, by Bill's definition.
Why it is "low priority" (Score:5, Insightful)
Re:Why it is "low priority" (Score:5, Insightful)
This "there is no program to exploit it, so this security issue is not important"-type of attitude is extremely dangerous. The slogan is to act, not to react, especially with security issues. And Microsoft actually should have learned from their part of history...
Cobblers. (Score:2)
Justin.
Re:Why it is "low priority" (Score:3, Insightful)
If I *had* a tool, I wouldn't be sharing it with you. Far too valuable. Generally, *you* wouldn't know if such a tool existed, because if knowledge of the tool leaked, MS *would* implement a fix, making future use problematic.
If the tool doesn't exist, I may well collect encrypted documents in case the tool is available in future - but you did know the temporal risk of encryption, no?
Anyway, in the "real life" of security, things work a bit differently. Almost anything at a "theoretical" level
Holography (Score:3, Funny)
Who uses word to protect anything? (Score:4, Insightful)
I guess what it comes down to is expectations of security. It should be obvious to not use word to protect national secrets. Secret love letters to your mistress are still probbably safe from your wife though (unless she happens to be a crypto-expert). In that case it's probbably easier to just use a keylogger, or install a trojan horse.
Cashcow (Score:2)
Comment removed (Score:5, Interesting)
Re:Encryption easily broken (Score:5, Insightful)
1) That password you give your administrator account on your system can be hacked off in under 5 minutes with the Emergency Boot CD EBCD . So much for encryption.
That doesn't have anything to do with encryption. Anytime you have physical access to a computer all bets are off as far as security. You can do the exact same thing in linux, and most of the time you don't even need a CD. Just add a 1 to the kernel boot options and boot into single user mode. No password required, immediate root access. Sure, you can put a password on changing those bootloader options, but just slap in a linux emergency boot CD, and suddenly you have root access to all files.
Linux encrypted filesystems I know almost nothing about, but I've also never seen a distribution that supports it out of the box. There's probbably one out their, but it's not a mainstream linux feature.
Re:Encryption easily broken (Score:2)
I know for a fact that Mandrake supports an EFS out of the box. I haven't run the other "major" distros (RH, SuSE) in some time, so I can't speak to those. But, in a corporate environment, the Linux encrypted FS has limited use -- there is no recoverable key infrastructure (which is good in some ways),
Physical access should not be sufficient! (Score:3, Insightful)
That's simply not true in this case. Preventing access to data when physical security is breached is the primary reason for encrypted filesystems. The thief who has unrestricted "physical access" to your work laptop should not be able to crack into an encrypted filesystem, Emergency Boot CD or no.
If the encryption key is sitting there on the hard drive, protected only by user-based access control (as the grandparent post
Linux encryptions (Score:3, Informative)
That doesn't have anything to do with encryption. Anytime you have physical access to a computer all bets are off as far as security.
The grandparent was saying that in Windows, it is easy to recover the Administrator's password. This is bad because you can log in without a recovery CD, and the Administrator won't notice (his password will s
wrong (Score:2)
Re:Encryption easily broken (Score:2, Interesting)
1) That password you give your administrator account on your system can be hacked off in under 5 minutes with the Emergency Boot CD EBCD . So much for encryption.
Reading the linked site, it says that you can *change* any password, not decrypt it. You can do the same thing in unix/linux if you have physical access, I also don't see anything wrong with that. If the data is that important, you should guard the computer as well. In the other case it's handy if for some reason the administrator password is l
Re:Encryption easily broken (Score:4, Informative)
NTLM hashes should not be stored on any system where security is even remotely important, for this reason. The newer hash function is secure (assuming the password can't be guessed).
Re:Encryption easily broken (Score:2, Informative)
Have you had a look at this: TrueCrypt: Free open-source disk encryption for Windows XP/2000/2003 [sourceforge.net]
Nothing to see here.... (Score:2)
In the interview referenced in the article, there is a paragraph that states
When contacted Microsoft, was unable to commit to a timescale for correcting the flaw but issued the following statement by way of a spokesperson: "Microsoft is still investigating this report of a possible vulnerability in Microsoft Office. When that investigation is complete, we will take the appropriate actions to protect customers. This may include providing a security update through our monthly release process."
Using my h
exploit available? (Score:2)
Indeed: what respect? (Score:4, Insightful)
Missed the purpose... (Score:2)
So, cryptopgraphic community perfectionism this time crosses interests of real power and will be ignored.
Ha, ha! (Score:5, Funny)
Dear security researchers,
You can try to crack our encryption all you want. Microsoft Office(TM) documents are still the most secure format in the world, since you still won't be able to render them properly even if you manage to decrypt them.
Sincerely,
The Microsoft Corporation
Users don't want strong MS Office encryption (Score:5, Insightful)
Sun Microsystems released Star Office, and a bunch of open source wonks built OpenOffice, with better track records. Yet US government offices shun them in favour of Microsoft Office.
I'm not sure why they do, especially an omniscent body like the US government who knows these things exist. It must be because they don't want to use them.
And every day users? Well, users could have taken e-mail content security into their own hands over a decade ago when PGP was out, or eight years ago when PGP for the Exchange client came out. But NO, they didn't want to use it. They could have used S/MIME which was slightly easier to use, but NO, they didn't want to use it.
Users don't care enough to demand strong encryption in their applications. And Microsoft is in business to make money. They aren't going to waste time making a product that no one will buy. And YOU, slashdotters, aren't going to convince users to buy an alternative through fear, uncertainty and doubt.
Re:Users don't want strong MS Office encryption (Score:3, Interesting)
Why doesn't Microsoft Have Good Security?
people who don't want or understand them
I swear I'm not making this up.
Re:Users don't want strong MS Office encryption (Score:3, Insightful)
Microsoft mail clients support SSL certificates though. SSL certificates cost you money. SSL certificate authorities provide kickbacks to Microsoft to include their CA key in MS products.
One more reason I hope Firefox/Thunderbird takes the world by storm: whoever controls the client controls which CAs are distributed with it. Oh, Verisign, you're being cunts again. Say goodbye to your CA key. Firefox/Thunderbird/Mozilla will also be able t
You're asking too much of MS (Score:4, Interesting)
Y'know, asking MS to fix an obscure bug in their encryption that took a dedicated researcher to find is pretty much pointless. Remember - these are the same guys that are having a hard time poking through their code and replacing all the strcpy() calls with strncpy().
Asking these guys to address this is like asking someone to turn off the faucet in a burning building.
Re:You're asking too much of MS (Score:3, Informative)
They didn't. The original poster was lying.
Instead, they completely rewrote the C library functions in much safer versions, sidestepping that problem entirely.
MS is well aware of the problems with strncpy. Read their blogs some time.
the Microsoft StrSafe library [microsoft.com]
ARRG (Score:2, Insightful)
USE A FUCKING MAC!!! [message authentication code]
cipher == privacy
mac == authentication
Stupid fucking reporting...
Tom
What's left to say? (Score:4, Insightful)
Maybe everyone is just burned out and tired of the topic. We all know that the state of PCs in the world today is a vast, pathetic farce of biblical proportions thanks to MS. What's left to say about it? Windows is a shitpile, but people keep gobbling it up. Just like they gobble up all the other sludge in our culture. Nothing unusual to be seen here. Move along.
Could this have been ON PURPOSE? (Score:4, Informative)
Could it be that the poor encryption security was actually on purpose?
After all, they were using RC4. It should be secure right? (sarcasm) Isn't the problem simply that they re-used a key stream, or something like that? Something that is a basic design "blunder", but could really have been done on purpose. This might make it easy for certian parties to crack, but it might still seem secure. All of the code is properly implemented. The RC4 algorithm is properly implemented, gives correct outputs for known inputs, etc. The flaw is in how the algorithm is improperly used. Something that could be missed by anyone disassembling the code.
I'll leave it for someone else to reply here and speculate on the reasons that such a "blunder" might actually be deliberate. (I've got a malfunction in one of the antennas of my tin foil hat. I use the dual-antenna design of tin foil hats.)
Re:Could this have been ON PURPOSE? (Score:2)
Rather unlikely. Their previous encryption scheme was far worse, and they could have kept using it. I doubt there was much pressure from customers to implement better cryptography. (There is little customer demand for increased security, either.)
All about shipping units... (Score:2)
If they truly cared about quality, there would be much less malware and and far fewer security holes in their products. They would actually care about this encrypti
Zimmerman bashes RC4, not just Microsoft (Score:3, Interesting)
When you own the playing field (Score:3, Insightful)
wha??? (Score:2)
Lets home MS drops their flawed encryption algorithm. How do the Office alternatives stack up in this respect?
Encryption schemes (Score:2)
Remember, just because you can't solve a problem you devised, does not necessarily mean it is insoluble, unless you proved so mathematically. For example, by expressing the encryption as a matrix multiplication and proving the matrix is singular. Preferably there should be more than one indeterminate variable,
why would it? (Score:2)
It's a big, stupid, ugly bug (Score:4, Insightful)
There is a lot of speculation here that Microsoft put in this encryption bug on purpose. That's giving them too much credit on this one. I just read the paper about the weakness. They are essentially reusing the same keystream more than once. That's an amateur level bug that is discussed in any crypto book that talks about stream ciphers. Look in the book Applied Crytography by Bruce Schneier in the section on cryptographic modes. He talks about this directly. This is not a minor threat. It's a gaping hole since a simple XOR of two versions of the document gives you a lot of information.
The bigger question is why Microsoft used a stream cipher for this. As Zimmerman mentions, they are more difficult to use correctly. Although some weakness in RC4 have been found, it is still possible to use it in a strong manner. You just have to be careful. It would have been better to use a good block cipher (AES, Triple DES, blowfish, etc) and a simple mode like CBC. It's easy to code and still plenty strong if you reuse the same initialization vector. Even better would have been a newer mode like CCM.
Just to play devil's advocate (Score:3, Insightful)
If we held car makers and home builders accountable for security flaws, our houses and cars would look a lot different, and they would STILL get broken into. I wouldn't want armed guards patrolling my neighborhood, or to go through an airport-like screening at the corner, any more than I would want to live the RIAA's wet dream of requesting authorization to display any video, sound or image with my own computer.
I wonder if the pursuit of total data security is a phantom, and we just have to accept a certain amount of risk and deal with it the best we can, possibly by not putting as much trust in our machines and networks as we would like to.
Re:Next Microsoft Crypto Method? (Score:2)
Re:Next Microsoft Crypto Method? (Score:2, Informative)
Re:Do they care? (Score:5, Interesting)
As to whether they 'care' about this encryption thing. They are obviously looking into it. But the fact is Office is run by millions of people, so they can't just overhaul the encryption system and release a hotfix without breaking lots of stuff. So these things take time. I do hope they change their methods, though.