TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

7-zip broken password random number generator

168 点作者 wyday超过 6 年前

10 条评论

tptacek超过 6 年前
This is getting a lot of play today on Twitter but it&#x27;s not all that consequential in the normal setting of a ZIP file.<p>The flaw they&#x27;re pointing out is that 7z&#x27;s AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability <i>in block ciphers</i> --- and uses a predictable RNG to generate the IV (for simplicity, just call it &quot;time and pid&quot;). 7z uses AES in CBC mode.<p>In CBC, you want IVs to be unpredictable; if you can predict an IV <i>and</i> you control some of the plaintext, you can in some cases make predictions about secret data that follows your controlled plaintext (this is an &quot;adaptive chosen plaintext&quot; attack).<p>This doesn&#x27;t really come up in 7z&#x27;s usage model; you&#x27;re supposing someone integrates 7z with their own application, which, on-demand, encrypts attacker-controlled data with a secret suffix and puts it somewhere the same attacker can see the resulting ciphertext. Don&#x27;t do this. In fact, if you&#x27;re using ZIP archives in your application, don&#x27;t use ZIP&#x27;s AES at all; encrypt yourself with a modern mode. ZIP AES isn&#x27;t meaningfully authenticated.<p>Having said all that: for the normal usage of an encrypted ZIP, this doesn&#x27;t really matter at all.<p>It&#x27;s a good finding, though! Cheers to anyone who takes the time to look at the underlying code for any popular cryptography. I hope they keep it up.<p>A more important PSA: unless you&#x27;re absolutely sure otherwise, you should always assume any ZIP program you&#x27;re using doesn&#x27;t actually encrypt password-protected ZIPs. It&#x27;s just as likely that it&#x27;s using the old, broken PKWARE cipher, which is dispiritingly common due to backwards-compat concerns. It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else (or just stick on a thumb drive), but ZIP encryption isn&#x27;t it.<p>Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we&#x27;re doing with it, 7z is fine. But it&#x27;s sad that it&#x27;s the best common denominator we have.
评论 #18983711 未加载
评论 #18983917 未加载
评论 #18983326 未加载
评论 #18983621 未加载
评论 #18983689 未加载
评论 #18983149 未加载
评论 #18983249 未加载
tomatotomato37超过 6 年前
&gt;I thought about reporting this at 7zip Sourceforge forums but then I vomited again when I saw a long thread of largely incoherent exchanges on how 7z should be using Twofish instead of AES-256 because...<p>Just because a bunch of tinfoils are arguing over whatever doesn&#x27;t mean you shouldn&#x27;t still report it! Just be sure to word the report more generic than usual so the hordes don&#x27;t find the issue and turn it into a battleground before a serious maintainer can get to it
评论 #18987370 未加载
评论 #18984934 未加载
评论 #18983327 未加载
deckar01超过 6 年前
It is not clear if anything is actually wrong here. It would be nice if someone who has spent more than &quot;30 minutes&quot; looking at this code could verify these claims and publish an article explaining the implications of these design choices.<p>The twitter thread that this is aggregated from has replies that seem to indicate that there is no practical exploit here.<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;3lbios&#x2F;status&#x2F;1087848040583626753" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;3lbios&#x2F;status&#x2F;1087848040583626753</a>
评论 #18982807 未加载
评论 #18984973 未加载
评论 #18983417 未加载
blibble超过 6 年前
not a cryptographer: but from memory the main quality important in an IV for CBC is that it isn&#x27;t reused for the same key (chosen plain-text attacks aside)<p>so that routine... while far from ideal would seem to mostly satisfy that property if you are making zip files of your own data to send to people (unless you use the same key rather a lot)
评论 #18982917 未加载
评论 #18982702 未加载
matthewaveryusa超过 6 年前
The attack here is:<p>1) You encrypt two pieces of data within the same second in the same process (so probably using the library?)<p>2) or if you&#x27;re using the command-line, the attack is you encrypt two pieces of data within the same second, and somehow wrap-around your pid within the second to get the same pid again.<p>That may be enough, or not enough -- but for those that claim that&#x27;s not enough, one needs to recognize the cognitive dissonance with reusing the same password<p>A monotonically increasing integer as IV is perfectly fine, and this dude is a bit out of his depth thinking IVs need to be random.
评论 #18982953 未加载
paulpauper超过 6 年前
It seems every few months we hear a story about something which is supposed to be secure not actually being secure or secure as expected.<p>Someone should make a bug bounty for all the major encryption programs, 7zp, wnzip, etc. Allocate 5 or so encrypted bitcoin private keys (with brute-force resistant passwords) for each program and see how long it lasts, with he public keys made public so people verify the status. if zip&#x27;s bounty has lasted years, then it&#x27;s reasonable to assume it&#x27;s safe.
评论 #18984337 未加载
评论 #18984154 未加载
saagarjha超过 6 年前
&gt; Open-source &quot;many eyes have looked at it for years so it must be secure&quot; crypto code.<p>Nobody claims this. Open source code is just easier to audit than non-open code.
评论 #18982739 未加载
评论 #18982719 未加载
endofcapital超过 6 年前
The way this is written reminds me why I try to never interact with security people in any social or professional situation, ever.<p>When is the insufferably arrogant techno mage trope going to die?
评论 #18986674 未加载
technion超过 6 年前
Addressing the debate this thread seems to have spawned, a practical attack on predictable CBC IVs is described here:<p><a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3008139&#x2F;why-is-using-a-non-random-iv-with-cbc-mode-a-vulnerability" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3008139&#x2F;why-is-using-a-n...</a><p>Therefore in a strict sense, this is &quot;broken&quot;. However, the &quot;I zipped a file and it to someone&quot; scenario is not one in which the above attack is practical.
paulpauper超过 6 年前
knowing the IV does not allow one to crack the message <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3225640&#x2F;how-to-decrypt-aes-cbc-with-known-iv" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3225640&#x2F;how-to-decrypt-a...</a><p><a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3225640&#x2F;how-to-decrypt-aes-cbc-with-known-iv" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;3225640&#x2F;how-to-decrypt-a...</a><p>the odds of the 7zip generator choosing an IV that corresponds to a re-USED IV for the same first block for a different message are very small and one would need to have access to this message
评论 #18983279 未加载