How to break XML encryption

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2011, Pages 413-422

  Jager, Tibor ^a   Somorovsky, J ^a  

^a RUHR UNIVERSITY BOCHUM   (Germany)

Author keywords

Security

Indexed keywords

BLOCK CIPHER MODES; BUSINESS COMMUNICATIONS; CHARACTER ENCODING; CIPHERTEXTS; FINANCIAL SERVICE; HEALTH CARE APPLICATION; MICROSOFT; MILITARY INFRASTRUCTURE; OPEN-SOURCE; ORACLE ATTACKS; PLAINTEXT; RESPONSE BEHAVIOUR; SECURITY; SECURITY THREATS; WEB-BASED APPLICATIONS; XML ENCRYPTION; XML FRAMEWORK;

CRYPTOGRAPHY; HEALTH CARE; MILITARY APPLICATIONS; USER INTERFACES; WEB SERVICES; XML;

SECURITY OF DATA;

EID: 80755169478     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2046707.2046756     Document Type: Conference Paper

References (20)

1. BLACK, J., AND URTUBIA, H. Side-channel attacks on symmetric encryption schemes: The case for authenticated encryption. In USENIX Security Symposium (2002), D. Boneh, Ed., USENIX, pp. 327-338.
2. BRAY, T., PAOLI, J., SPERBERG-MCQUEEN, C. M., MALER, E., AND YERGEAU, F. Extensible Markup Language (XML) 1.0 (Fifth Edition). W3C Recommendation (2008).
3. DEGABRIELE, J. P., AND PATERSON, K. G. Attacking the IPsec standards in encryption-only configurations. In IEEE Symposium on Security and Privacy (2007), IEEE Computer Society, pp. 335-349. (Pubitemid 47432539)
4. DEGABRIELE, J. P., AND PATERSON, K. G. On the (in) security of IPsec in MAC-then-encrypt configurations. In A CM Conference on Computer and Communications Security (2010), E. Al-Shaer, A. D. Keromytis, and V. Shmatikov, Eds., ACM, pp. 493-504.
5. DUONG, T., AND RIZZO, J. Cryptography in the web: The case of cryptographic design flaws in ASP.NET. In IEEE Symposium on Security and Privacy (2011).
6. EASTLAKE, D., REAGLE, J., IMAMURA, T., DILLAWAY, B., AND SIMON, E. XML Encryption Syntax and Processing. W3C Recommendation (2002).
7. EASTLAKE, D., REAGLE, J., SOLO, D., HIRSCH, F., AND ROESSLER, T. XML Signature Syntax and Processing (Second Edition). W3C Recommendation (2008).
8. GUDGIN, M., HADLEY, M., MENDELSOHN, N., MOREAU, J.-J., AND NIELSEN, H. F. SOAP Version 1.2 Part 1: Messaging Framework. W3C Recommendation (2003).
9. JBoss COMMUNITY. JBOSS WS (Web Services Framework for JBoss AS).
10. McINTOSH, M., AND AUSTEL, P. XML signature element wrapping attacks and countermeasures. In SWS '05: Proceedings of the 2005 workshop on Secure web services (New York, NY, USA, 2005), ACM Press, pp. 20-27.
11. MITCHELL, C.J. Error oracle attacks on cbc mode: Is there a future for cbc mode encryption? In ISC (2005), pp. 244-258.
12. NADALIN, A., KALER, C, MONZILLO, R., AND HALLAM-BAKER, P. Web Services Security: SOAP Message Security 1.1 (WS-Security 2004). OASIS Standard (2006).
13. PATERSON, K. G., AND WATSON, G. J. Immunising CBC mode against padding oracle attacks: A formal security treatment. In SCN (2008), R. Ostrovsky, R. D. Prisco, and I. Visconti, Eds., vol. 5229 of Lecture Notes in Computer Science, Springer, pp. 340-357.
14. PATERSON, K. G., AND YAU, A. Padding oracle attacks on the ISO CBC mode encryption standard. In Topics in Cryptology - CT-RSA 2004 (Feb. 2004), T. Okamoto, Ed., vol. 2964 of Lecture Notes in Computer Science, Springer, pp. 305-323.
15. RIZZO, J., AND DUONG, T. Practical padding oracle attacks. In Proceedings of the 4th USENIX conference on Offensive technologies (Berkeley, CA, USA, 2010), WOOT'10, USENIX Association, pp. 1-8.
16. ROBERT A. VAN ENGELEN. The gSOAP Toolkit for SOAP Web Services and XML-Based Applications.
17. THAI, T., AND LAM, H. .NET Framework Essentials. 2001.
18. THE APACHE SOFTWARE FOUNDATION. Apache Axis2.
19. VAUDENAY, S. Security flaws induced by CBC padding - applications to SSL, IPSEC, WTLS⋯ In Advances in Cryptology - EUROCRYPT 2002 (Apr. / May 2002), L. R. Knudsen, Ed., vol. 2332 of Lecture Notes in Computer Science, Springer, pp. 534-546.
20. YAU, A. K. L., PATERSON, K. G., AND MITCHELL, C.J. Padding oracle attacks on CBC-mode encryption with secret and random IVs. In Fast Software Encryption - FSE 2005 (Feb. 2005), H. Gilbert and H. Handschuh, Eds., vol. 3557 of Lecture Notes in Computer Science, Springer, pp. 299-319. (Pubitemid 41425171)