Security standards should guarantee security, especially on the web.
The World Wide Web Consortium (W3C), the main force behind standards like HTML, XML, and XML Encryption, is now saying “not so fast.” They said implementing a W3C standard does not mean that a system is secure.
Researchers from the chair of network and data security found a serious attack against XML Encryption. “Everything is insecure”, is the message from Ruhr-University Bochum, in Germany.
XML stands for “eXtensible Markup Language”, and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Web service projects for large customers. The goal of XML Encryption is to protect the confidentiality of the exchanged data. That very idea was the reason researchers wanted to take a closer look at its security.
Juraj Somorovsky and Tibor Jager exploited a weakness in the Cipher-Block Chaining (CBC) mode for different ciphertext blocks.
“We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages,” Somorovsky said.
They tested the attack against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure – in all cases the result was the same: The attack works, XML Encryption is not secure. The researchers gave details of the attack at this year’s ACM Conference on Computer and Communications Security in Chicago.
“There is no simple patch for this problem,” Somorovsky said. “We therefore propose to change the standard as soon as possible.”
The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.