tl;dr Mozilla Firefox prior to version 72 suffers from Small Subgroups Key Recovery Attack on DH in the WebCrypto 's API. The Firefox's team fixed the issue r emoving completely support for DH over finite fields (that is not in the WebCrypto standard). If you find this interesting read further below. Premise In this blog post I assume you are already knowledgeable about Diffie-Hellman over finite…
About a year ago I wrote this tweet and now I can finally justify it Project Wycheproof ( https://t.co/wBz9P8atHs ) is the AFL ( https://t.co/JM2l557PZi ) of #crypto . Thanks a lot @XorNinja and team (notably including Bleichenbacher) for providing such a powerful tool — Antonio Sanso (@asanso) April 9, 2018 it is more or less when I found the vulnerabilities discussed in this short post.…
So here we are in the nice city of Bern, in the Teutonic Switzerland, for SIAM Conference on Applied Algebraic Geometry 2019 that this year counts more than 750 attendees! The weather is warm enough but the isogenies topic has never been so hot! So for this occurrence of the conference Tanja Lange , Chloe Martindale and Lorenz Panny managed to organise a really great isogenies mini-symposium…
This continues the post from part 1 . In the previous post we discussed about Verifiable Delay Functions . Here is a quick summary of what we discussed in the first part: We covered the definition of Verifiable Delay Functions (VDF). We have seen a short history of how this idea slowly developed. We hinted the existence of some constructions. We described some application with an eye on the…
Update: you can find the Part II of this series here In this blog post I am going to talk about some really cool cryptographic research done by Luca De Feo , Simon Masson , Christophe Petit and myself around a relatively new cryptographic construction called Verifiable Delay Functions ( VDF from now on). I know at this point you are thinking that the title of this blog post was yet another…
tl;dr I found an XSRF in the OAuth implementation of Redhat Keycloak Gatekeeper . This would be a bit worse for people using Gatekeeper to protect their Kubernetes Dashboard (especially in Microsof Azure). The Issue in Keycloak Gatekeeper Keycloak Gatekeeper is an OpenID Proxy service for Keycloak , an Identity and Access Management solution developed and opensourced by RedHat (now IBM). Solutions…
tl;dr https://sites.google.com suffered from a Billion Laugh Attack vulnerability that made the containerized environment to crash with a single invocation. Introduction Few months ago I applied for a talk at a security conference titled So you wanna be a Bug Bounty Hunter but it was rejected :( . The reason behind it is that I have been on/off in the bug bounty business for a while as you can see…
See also Part I and Part II of this series This is going to be a short blog post about the (in)famous Micali-Schnorr Random Number Generator (MS-DRBG). See Part I and Part II of this series for more information about this topic. WHO: NIST published the specification for Micali-Schnorr Random Number Generator (MS-DRBG) in NIST Special Publication 800-90 ISO 18031. Along with the explanation of the…
People that knows me well are well aware that prime numbers have been my obsession since my childhood and they are source of continue interest for me. Actually thanks to cryptography they are a relevant part of my everyday life. One of the most important problem in cryptography since the discovery of RSA is factoring . The factoring problem consists of finding the prime numbers p and q given a…
tl;dr in this blog post I am going to talk about some bug bounty left over with a little rant. Here you can find bug bounty left over part I and II Here you can find bug bounty rant part I and II Introduction In one of my previous post I was saying that: "The rule #1 of any bug hunter... is to have a good RSS feed list." Well well well allow me in this post to state rule #2 (IMHO) "The rule #2 of…
Ho appena finito di scrivere a proposito dei miei 3 giorni trascorsi al Real World Crypto 2018 (il blog post per chi legge inglese e' qui ) e mi sono accorto che non c'e' traccia di nessuna Universita' (ma anche azienda) italiana. Tutto cio' non puo' che rendermi un po' triste. L'Italia aveva una posizione di rilievo nell'"antica" crittografia. Non ci dimentichiamo dell'ormai super obsoleto (ma…
The 2018 edition of Real World Crypto (RWC) was in Zurich (you can find the conference full program here .). I live in Switzerland so I was extremely happy about it. RWC is basically the best conference I ever attended and it will probably be so for a while. I almost risked to skip it due to flu but I eventually managed to attend :) Current status: -1 to #realworldcrypto . Me sick in bed :( —…
See also Part I and Part III of this series tl;dr In the previous article of the same series we tried to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization. In this blog post we continue the effort started in part I showing different strategies. If you want to skip all my failures and go directly to the (in my humble opinion) most promising approach you can read…
tl;dr I found a severe issue in the Slack 's SAML implementation that allowed me to bypass the authentication. This has now been solved by Slack. Introduction IMHO the rule #1 of any bug hunter (note I do not consider myself one of them since I do this really sporadically) is to have a good RSS feed list. In the course of the last years I built a pretty decent one and I try to follow other…
The article was modified since its publication. Last update was 09/10/2017 See also Part II and Part III of this series tl;dr in this post we are going to describe how to try predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization of the n value. If this sounds like, "why the hell should I care?" , you might want to give a look at this great post from Matthew Green about…
tl;dr Firefox and Java suffered from a moderate vulnerability affecting the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result POINT_AT_INFINITY when it should not. Introduction Few months ago I was working on a vulnerability affecting the internet standard JWE (slides here ) and I got a stroke of luck . Yuppieeee Basically I was…
Disclaimer Questo blog post e' scritto da evariste.gal0is ed Antonio Sanso . Entrambi gli autori non hanno nessuna affiliazione politica ed il post ha l'unico scopo di fornire un'analisi tecnica di parte dei dump relativa alle password. Riassunto delle puntate precedenti In data 2 agosto 2017 uno dei coautori di questo blog post ( evariste.gal0is ) ha segnalato Il sito Rousseau del M5S è…
tl;dr This short blog post serves to me to recollect some of the thing I have been learning ( climbing ) about Elliptic Curves Cryptography (ECC from now on) during the last months/years, so please take it with a grain of salt since it might contains some erroneous beliefs. '80 - Introduction Giambattista Vico was an Italian political philosopher and rhetorician, historian and jurist, of the Age…
Yesterday while reading my Twitter stream I found this interesting article about downloading GitHub SSO bypass codes . Same as Yasin Soliman I was invited to a Github pre-release of the organisation SAML single sign-on (SSO) private program. And same as him I found an issue in the same endpoint. So I thought to write a quick blog post about it. Github already published a tl;dr about this, I will…
We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" (really??) was based on a really spread Internet procol named OAuth . It also turns out that during the early stage of the standardization someone…
Note this is going to be a quick post. This year, at Enigma 2017 Conference , Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question . After the presentation the moved operationally and presented the first integration partner : Github . These days I have seen a lot of press around this and both Facebook and Github open sourced their implementation and s…
tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF (defined by Egor Homakov as the the Most Common OAuth2 Vulnerability ), see video below: Introduction Facebook Groups offers the option to upload files directly from the Dropbox account: This will…
tl;dr if you are using go-jose , node-jose , jose2go , Nimbus JOSE+JWT or jose4j with ECDH-ES please update to the latest version. RFC 7516 aka JSON Web Encryption (JWE) hence many software libraries implementing this specification used to suffer from a classic Invalid Curve Attack . This would allow an attacker to completely recover the secret key of a party using JWE with Key Agreement with…
tl;dr I was able to hijack the OAuth tokens of EVERY Paypal OAuth application with a really simple trick. Introduction If you have been following this blog you might have got tired of how many times I have stressed out the importance of the redirect_uri parameter in the OAuth flow. This simple parameter might be source of many headaches for any maintainer of OAuth installations being it a client…
Back in January I posed a question "to the Internet": What the heck is RFC 5114? It looks like a lot happened since then around it. I would like to use this post to recollect some of the stuff around RFC5114 . Chapter 0: October 2007 RFC5114 draft was submitted to the IETF . Chapter I: January 2016 In short RFC5114 is an IETF Informational RTC that " describes eight Diffie-Hellman groups that can…
