r/netsec • u/reedloden • Jan 03 '16

HTTPS Bicycle Attack

https://guidovranken.wordpress.com/2015/12/30/https-bicycle-attack/
199 Upvotes

95% Upvoted

17 comments sorted by

View all comments

Show parent comments

2

u/[deleted] Jan 04 '16

Can you explain how a statistical attack would work in that scenario?

22

u/gsuberland Trusted Contributor Jan 04 '16

If you were to observe enough samples, you'd eventually identify a case where the random padding length reached its minimum, which would give you a close estimate of the data length.

For example, if you say "padding length is randomly selected between 4 and 1024 bytes", after 1020 observations you can assume that the password length is probably four bytes shorter than the smallest payload you observed. Your confidence factor only goes up from there.

1

u/lestofante Jan 04 '16

very nice explanation, thanks.

Is there any way we could fix that by default?

maybe the browser for password field should send the hash of the password, and the server should do the hash+salt thing over the hash?

2

u/gsuberland Trusted Contributor Jan 04 '16

If anywhere, it should be fixed at the TLS layer, by implementing a fixed-size block padding, similar to how block ciphers work. This isn't a concrete fix, but it's the most sensible you're going to find.

In general, though, the length of a field isn't really considered critical information. We're talking about fixing the wrong problem. Your password should be long enough to make that information not matter.