Featured Research

from universities, journals, and other organizations

Internet security: Researchers break W3C standard

Date:
October 19, 2011
Source:
Ruhr-Universitaet-Bochum
Summary:
Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure", is the uncomfortable message from the researchers.

Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure," is the uncomfortable message from Bochum.

Standard for large integration projects

XML stands for "eXtensible Markup Language," and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.

Weak chaining of ciphertext blocks

Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. "We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages." The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure -- in all cases the result was the same: the attack works, XML Encryption is not secure.

Details of the attack are presented at this year's ACM Conference on Computer and Communications Security (http://www.sigsac.org/ccs/CCS2011/techprogram.shtml).

No simple solution available

„There is no simple patch for this problem," states Somorovsky. "We therefore propose to change the standard as soon as possible." The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.


Story Source:

The above story is based on materials provided by Ruhr-Universitaet-Bochum. Note: Materials may be edited for content and length.


Cite This Page:

Ruhr-Universitaet-Bochum. "Internet security: Researchers break W3C standard." ScienceDaily. ScienceDaily, 19 October 2011. <www.sciencedaily.com/releases/2011/10/111019104907.htm>.
Ruhr-Universitaet-Bochum. (2011, October 19). Internet security: Researchers break W3C standard. ScienceDaily. Retrieved August 2, 2014 from www.sciencedaily.com/releases/2011/10/111019104907.htm
Ruhr-Universitaet-Bochum. "Internet security: Researchers break W3C standard." ScienceDaily. www.sciencedaily.com/releases/2011/10/111019104907.htm (accessed August 2, 2014).

Share This




More Computers & Math News

Saturday, August 2, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Google Mystery Barge Headed For The Scrap Yard

Google Mystery Barge Headed For The Scrap Yard

Newsy (Aug. 1, 2014) We may never know what was going on inside one of Google's mystery barges in Portland, Maine as it's now headed for the scrap yard. Video provided by Newsy
Powered by NewsLook.com
Escaping Email: Inspired Vision or Pipe Dream?

Escaping Email: Inspired Vision or Pipe Dream?

AP (Aug. 1, 2014) Dustin Moskovitz is plotting an escape from email, using his communications expertise in an attempt to change the way people connect at work, where the incessant drumbeat of email has become an excruciating annoyance. (Aug. 1) Video provided by AP
Powered by NewsLook.com
Google (Kind Of) Complies With 'Right To Be Forgotten Law'

Google (Kind Of) Complies With 'Right To Be Forgotten Law'

Newsy (July 31, 2014) Google says it is following Europe's new "Right To Be Forgotten Law," which eliminates user information upon request, but only to a certain degree. Video provided by Newsy
Powered by NewsLook.com
Tesla, Panasonic Ink Deal To Make Huge Battery 'Gigafactory'

Tesla, Panasonic Ink Deal To Make Huge Battery 'Gigafactory'

Newsy (July 31, 2014) The deal will help build a massive battery factory that Tesla says will produce 500,000 lithium batteries by 2020. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins