6 ms·

They commented on this on Reddit: https://www.reddit.com/r/fulldisclosure/comments/3anfjk/tutanota_encrypted_email_service_malleable/ https://www.reddit.com/r/

They commented on this on Reddit: https://www.reddit.com/r/fulldisclosure/comments/3anfjk/tutanota_encrypted_email_service_malleable/ https://www.reddit.com/r/fulldisclosure/comments/3anfjk/tuta... "This is not a vulnerability in Tutanota. We have built Tutanota with multiple layers of protection for our users. We currently use TLS and DANE to protect authentication and data integrity and (only tunneled) RSA-OAEP and AES-CBC to provide confidentiality. We have always communicated this transparently, it is nothing new. Neither the confidentiality nor the integrity of our users' data has been at risk. However, we know that the implementation is not perfect regarding this detail. That is why we are going to implement the following features as soon as possible: - Signatures/MAC - 2-factor authentication - Algorithms resistant to attacks of quantum computers - Simple verification of downloaded Tutanota apps Regarding the described issue, we know of two possible attacks on AES-CBC. Neither of them is feasible against Tutanota users: - Bit flipping: You need access to the plain text email and you have to be the MITM. - -Plaintexts are available at the sender and recipient only. We use secure TLS algorithms and DANE to protect against MITM. - Padding oracle: There is no padding oracle in Tutanota. Tl;dr There is no known vulnerability in Tutanota. Security is the heart of Tutanota, and we will fix vulnerabilities immediately."

hannob 11y ago
Or in other words: No, they haven't fixed it. And the answer is a mix of "we don't really understand crypto" and "you should trust us".
tedunangst 11y ago
Pretty sure you can do bit flipping without access to the plaintext...
- sarciszewski 11y ago
  Yeah. In addition to the Crypto Pals challenges, I actually used this to prove a point (with contrived example): https://paragonie.com/blog/2015/05/using-encryption-and-authentication-correctly#title.2.1 https://paragonie.com/blog/2015/05/using-encryption-and-auth...
tptacek 11y ago
An end-to-end encrypted messaging company claiming to use DANE to protect end-users. Sheesh.
- 3pt14159 11y ago
  Also a laughable difficulty algorithm for the password: https://imgur.com/JX7Vyje https://imgur.com/JX7Vyje (Mix of random numbers and symbols)
- sarciszewski 11y ago
  Especially when the objection I raised is that the server can perform privileged active attacks on the client software. I'd say avoid Tutanota.
sarciszewski 11y ago
They seem to confuse digital signatures with message authentication. > Padding oracle: There is no padding oracle in Tutanota. Interesting claim. They're using PKCS5 which means that, yes, there is a padding oracle vulnerability, but triggering it is orders of magnitude more difficult than null padding. https://github.com/tutao/tutanota/blob/tutanota-1.9.2+/native/src/android/de/tutao/plugin/Crypto.java#L58 https://github.com/tutao/tutanota/blob/tutanota-1.9.2+/nativ...
- MatthiasPfau 11y ago
  > They seem to confuse digital signatures with message authentication. Why do you think that? Of course we (I am one of the founders of Tutanota) understand the difference of the two. > They're using PKCS5 which means that, yes, there is a padding oracle vulnerability Could you please describe the padding oracle? Knowing the padding algorithm is not enough to make up a padding oracle. The oracle must be able to decrypt the cipher text in order to tell the attacker if the padding is valid or not.
  - sarciszewski 11y ago
    > Why do you think that? Of course we (I am one of the founders of Tutanota) understand the difference of the two. Because you put them on the same line item. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass... > Could you please describe the padding oracle? Knowing the padding algorithm is not enough to make up a padding oracle. The oracle must be able to decrypt the cipher text in order to tell the attacker if the padding is valid or not. For fuck's sake, Google it. The top two search results explain it perfectly. http://robertheaton.com/2013/07/29/padding-oracle-attack http://robertheaton.com/2013/07/29/padding-oracle-attack https://blog.skullsecurity.org/2013/padding-oracle-attacks-in-depth https://blog.skullsecurity.org/2013/padding-oracle-attacks-i... TL;DR if you aren't using authenticated encryption, because you're using CBC mode with a block cipher, an attacker can keep sending forged messages until it decrypts successfully. It's much easier to forge messages on zero byte padding than exploit PKCS(5|7), but attackers can still exploit padding errors to tell if their message decrypted.

hannob 11y ago

Or in other words: No, they haven't fixed it. And the answer is a mix of "we don't really understand crypto" and "you should trust us".

tedunangst 11y ago

Pretty sure you can do bit flipping without access to the plaintext...

sarciszewski 11y ago
Yeah. In addition to the Crypto Pals challenges, I actually used this to prove a point (with contrived example): https://paragonie.com/blog/2015/05/using-encryption-and-authentication-correctly#title.2.1 https://paragonie.com/blog/2015/05/using-encryption-and-auth...

tptacek 11y ago

An end-to-end encrypted messaging company claiming to use DANE to protect end-users. Sheesh.

3pt14159 11y ago
Also a laughable difficulty algorithm for the password: https://imgur.com/JX7Vyje https://imgur.com/JX7Vyje (Mix of random numbers and symbols)
sarciszewski 11y ago
Especially when the objection I raised is that the server can perform privileged active attacks on the client software. I'd say avoid Tutanota.

sarciszewski 11y ago

They seem to confuse digital signatures with message authentication. > Padding oracle: There is no padding oracle in Tutanota. Interesting claim. They're using PKCS5 which means that, yes, there is a padding oracle vulnerability, but triggering it is orders of magnitude more difficult than null padding. https://github.com/tutao/tutanota/blob/tutanota-1.9.2+/native/src/android/de/tutao/plugin/Crypto.java#L58 https://github.com/tutao/tutanota/blob/tutanota-1.9.2+/nativ...

MatthiasPfau 11y ago
> They seem to confuse digital signatures with message authentication. Why do you think that? Of course we (I am one of the founders of Tutanota) understand the difference of the two. > They're using PKCS5 which means that, yes, there is a padding oracle vulnerability Could you please describe the padding oracle? Knowing the padding algorithm is not enough to make up a padding oracle. The oracle must be able to decrypt the cipher text in order to tell the attacker if the padding is valid or not.
- sarciszewski 11y ago
  > Why do you think that? Of course we (I am one of the founders of Tutanota) understand the difference of the two. Because you put them on the same line item. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass... > Could you please describe the padding oracle? Knowing the padding algorithm is not enough to make up a padding oracle. The oracle must be able to decrypt the cipher text in order to tell the attacker if the padding is valid or not. For fuck's sake, Google it. The top two search results explain it perfectly. http://robertheaton.com/2013/07/29/padding-oracle-attack http://robertheaton.com/2013/07/29/padding-oracle-attack https://blog.skullsecurity.org/2013/padding-oracle-attacks-in-depth https://blog.skullsecurity.org/2013/padding-oracle-attacks-i... TL;DR if you aren't using authenticated encryption, because you're using CBC mode with a block cipher, an attacker can keep sending forged messages until it decrypts successfully. It's much easier to forge messages on zero byte padding than exploit PKCS(5|7), but attackers can still exploit padding errors to tell if their message decrypted.