Bar mitzvah attack

The bar mitzvah attack is an attack on the SSL/TLS protocols that exploits the use of the RC4 cipher with weak keys for that cipher.[1][2] While this affects only the first hundred or so bytes of only the very small fraction of connections that happen to use weak keys, it allows significant compromise of user security, for example by allowing the interception of password information[2] which could then be used for long-term exploitation.

The attack uses a vulnerability in RC4 described as the invariance weakness by Fluhrer et al. in their 2001 paper on RC4 weaknesses.[2][3]

The attack is named after the bar mitzvah ceremony which is held at 13 years of age, because the vulnerability exploited is 13 years old.[1]

See also

References

  1. 1 2 Kelly Jackson Higgins (26 March 2015). "SSL/TLS Suffers 'Bar Mitzvah Attack'". Dark Reading.
  2. 1 2 3 Dan Goodin (27 March 2015). "Noose around Internet’s TLS system tightens with 2 new decryption attacks". Ars Technica.
  3. ↑ Fluhrer, S., Mantin, I., and A. Shamir, "Weaknesses in the Key Scheduling Algorithm of RC4", Selected Areas of Cryptography: SAC 2001, Lecture Notes in Computer Science Vol. 2259, pp 1–24, 2001.


This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.