TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

MD5 hash extension attack breaks API authentication in Flickr (and others)

58 点作者 brl超过 15 年前

5 条评论

tptacek超过 15 年前
Good work from Bruce Leidl's team at Netifera (Bruce is brl, a regular).<p>Long story short: with all the mainstream hash algorithms, if you know the length of a hashed message, you can take its hash and from it synthesize the hashes of messages with arbitrary suffixes. It's called a message extension attack.<p>A really common pattern in hand-rolled authentication schemes is to hash a message needing authentication with a secret key, and then send the message and the hash. If you know the secret key, you can verify the message. The secret key doesn't need to be sent at all.<p>If your scheme is vulnerable to message extension attacks, attackers can mint arbitrary messages with valid authentication by taking an already-authenticated message and extending it to cover a suffix that changes the meaning of the legitimate message. It's a game-over flaw.<p>Colin Percival noticed a related (but less serious) flaw in Amazon's AWS authentication scheme. At the time, people asked if he'd looked at Flickr's scheme. He had, but not very closely. Colin's flaw was in canonicalization of messages, which is a more obscure attack (by a little bit) than message extension, which is is described in the Wikipedia under "Cryptographic Hash Function". Colin didn't flag this flaw.<p>Which just shows to go you: crypto primitives are radioactive. You are not going to get them right. Use high-level interfaces like GPG or SSL or cryptlib, or design your app not to need crypto.
评论 #849877 未加载
评论 #853288 未加载
评论 #849389 未加载
wizard_2超过 15 年前
This reminds me a lot of the problem the amazon s3api v1 suffered from. (It's referenced in this paper.) Colin Percival did a wonderful job alerting amazon and getting it fixed. Reading the paper it looks like they tried to alert people, but they didn't go into detail.<p>You can read more about the amazon problem at Colin's blog. <a href="http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-insecure.html" rel="nofollow">http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver...</a>
idlewords超过 15 年前
Yahoo has dedicated internal people who, if you ask them nicely, will pick your app apart to find these kinds of design and implementation errors. Reviewing your code with them is very educational but not pleasant to the ego. Either they completely fell down on the job, or the Flickr devs decided they were smart enough to do security by themselves.
评论 #849093 未加载
评论 #848935 未加载
juli超过 15 年前
Sites using this vulnerable signing method must add a warning to their documentation.<p>Flickr authentication spec lists ludicorp.com authors,<p><a href="http://www.flickr.com/services/api/auth.spec.html" rel="nofollow">http://www.flickr.com/services/api/auth.spec.html</a>
pwpwp超过 15 年前
The takeaway for me was: 1) use a HMAC instead of using message digests directly 2) don't throw away structure in the strings you sign.
评论 #853273 未加载