undefined | Better HN

0 pointsthinkzig15y ago0 comments

Who's writing recommendations that say "switching ciphers fixes the problem"?

Visual Studio Magazine [1].

I've enjoyed reading all your comments on this thread. You clearly know your stuff. Based upon what you've seen so far and what you know about the ASP.NET framework, do you see any way around this short of some patch from Microsoft?

[1] - http://visualstudiomagazine.com/articles/2010/09/14/aspnet-s...

0 comments

2 comments · 1 top-level

tptacek15y ago· 1 in thread

The funny part about this story is that Thai's video (of him breaking DotNetNuke) breaks a 3DES key. The great thing about CBC padding and bitflips is that it's inherent to the block cipher mode; switch to DES-EDE, MARS, Twofish, or Serpent and you still have the same vulnerability. You don't even need to know how the algorithm is implemented! The same exploit will work, regardless of the underlying exploit.

You gotta love crypto.

tptacek15y ago

Underlying cipher, sorry.

j / k navigate · click thread line to collapse