ESAPI Crypto Changes

on YouTube ↗09m

" summary

ESAPI symmetric encryption has a concrete fix and followups: a PoC allowed setting MAC length to zero and enabled a padding‑oracle path so CVE-2013-5960 is addressed in 2.1.0 (released 2013-02-02) and a redesign targets 2.1.1. Changes include remove singleton Java encryptor, add explicit KDF context to derive separate MAC and encryption keys, default PRF HMAC-256, branch kww_crypto_d211 holds in-progress code and destructive tests, and work ensures backward decryption compatibility.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 1:01Overwrite MAC length and set to 0 and erase MAC → Causes bypass of authenticity check. Could potentially lead to padding oracle attack -Root cause was code left in for ESAPI 1.4 backward compatibility (since removed) - Fixed in ESAPI 2.1.0, released 2013-09-02
3. 2:42Precautionary measure: potentially changes to cipher transformation or version date, etc. could stil permit authenticity bypass - Being fixed in ESAPI 2.1.1; requires minor redesign of key derivation and MAC computation. . Code in brancheskww.crypto-2.1.1 • Needs some minor code additions
4. 5:30Pre-2.1.1, the MAC and encryption keys were derived from the main key with no additional context. • In 2.1.1 and later, it's like this

" related talks

• 24mOWASP ESAPI – A Retrospective: The Good, the Bad, & the UglyKevin Wall · OWASP 20th Anniversary 2021
• 47mOWASP ESAPI – A Retrospective: The Good, the Bad, & the UglyKevin Wall · Global AppSec US 2021 Virtual
• 30mAre we using Java Crypto API Securely ?Mansi Sheth · OWASP AppSec USA 2018
• 36mSig Auth Deep DiveTim Allclair, Rita Zhang, Mo Khan · KubeCon + CloudNativeCon North America 2022
• 32mEncryption - A Deeper ReviewAdam Perella · PAYMENTSfn 2019
• 01h 01mBroken crypto is brokenErlend Oftedal · NDC Sydney 2018
• 32mForay into modern symmetric cryptoDmitry Groshev · :clojureD 2017
• 44mMobiconf 2018: Marcin Krzyzanowski, PSPDFKit GmbHMarcin Krzyzanowski · Mobiconf 2018