> Break Me If You Can
This, somehow, triggered my mind to recall LifeLock's CEO Todd Davis’s public marketing campaign where he displayed his Social Security number on the company website and advertisements to demonstrate the security of his platform, however, the challenge backfired dramatically and he becomes a victim of identity theft on at least 13 separate occasions.
Looks awesome! I see some Flipper Zero apps were already created. When will you be releasing this for the Chameleon? Also, any plans to port this over to the Proxmark?
All of the attacks are released for the three platforms (Proxmark3, Flipper Zero, and Chameleon Ultra). Our goal was day 1 support for RFID testing devices.
3DES has been broken for a decade. Nice job putting it all together though.
> Is this a flaw in the cryptography itself? No. The underlying cryptographic algorithms (3DES and AES-128) remain secure. The vulnerabilities arise from:
Protocol design choices that allow unauthenticated memory writes after initial authentication Lack of atomicity when writing cryptographic keys across multiple memory pages Widespread misconfiguration in real-world deployments (unlocked memory, static keys) Non-NXP compatible chips with severely flawed random number generators
It has? What exactly do you mean by that?
It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can'
BREAKMEIFYOUCAN! is the default factory key programmed into every MIFARE Ultralight C chip by NXP.
Ok that makes much more sense.
How exactly would you decrypt a 3DES ciphertext "with little effort"?
It's supported in hashcat
Is this a bit?
Have you tried it?
We're talking about symmetric ciphers and you're talking about password cracking software.
Triple-DES has 168 bit keys. Even if you use a meet-in-the-middle attack, your attack cost has an exponent of 112 (with an associated memory cost with an exponent of 88).
That's not practically exploitable today.
If you think I'm wrong, here's a single block message encrypted with 3DES, then hex-encoded. Have fun:
But really, the bigger problem is Sweet32.924db449f52ea976
Surely someone who has been here as long as you have understands that this type of behavior is not compatible with the guidelines.
> Converse curiously; don't cross-examine.
You could have just corrected them and not goaded them into further revealing their ignorance. Yes, they underestimated how difficult it is to crack 3DES. You could have simply told them that.
I have no idea who they are or what they were talking about. I think they're thinking about 3DES used as a password hash. I never in 100 years would have guessed that's where they were coming from.
The thread that ensued, a discussion of what it means for a cipher to be obsoleted or unsafe versus "broken", is an actually-interesting question.
I feel pretty OK about how this went.
You could never, in a million years, have guessed by "broken" they meant "it can be decrypted by the public with little effort?" I doubt that. I see no evidence they are talking about a password hash. Here's what they actually cited:
> The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, ...
They're clearly talking about it's use as a cipher. Again, someone who has been here as long as you have should understand that you shouldn't put words in their mouth or be evasive in this way.
The conversation would still have touched on these interesting topics, and would likely have done so more immediately.
Do we have conflicting premises about what Hashcat is? I'm pretty sure you're just wrong here.
Do we have conflicting premises about what SSH is? I'm pretty sure you're dodging and deflecting from the actual issues here.
They were clearly suggesting that there exists a publicly available tool to attack this algorithm. They clearly didn't care one way or the other about whether it was used in passwords. What they actually cited was vulnerabilities in network services.
You are being disingenuous. Cut it out.
What are you talking about? No there isn't. There is no "publicly available tool to attack 3DES". Hashcat is a password cracker. You know what else it supports? AES. Is AES broken?
It's very difficult for me to imagine a way you could have read my remarks in good faith and come to that conclusion. I hope someday you figure this out, I guess I have no hope of explaining it.
Here's a simple question. When you said:
They were clearly suggesting that there exists a publicly available tool to attack this algorithm.
What were you referring to? If it was Hashcat, then I have just one more question:
Is Hashcat a publicly available tool that attacks AES?
I'm not going back and forth with you if you're not going to discuss the thrust of our disagreement. I am not wading into this minutia with you. I see the game you are playing to evade the subject I am trying to discuss; I'm not interested in playing.
Ok! Seems simple, though.
this is a very common pattern in tptacek's comments, but it's not worth calling out as he absolutely refuses to recognize it, always falling back to a similar response you see here.
with a quick google of "3des broken" and reading the first paragraph of wikipedia on 3des, i was able to guess (correctly!) what they original commenter was referring to.
It's pretty self-indulgent of me to respond to this comment, but just real quick: the pattern you're seeing is me in fact not being one of the top-tier experts in cryptography on Hacker News (just one of the loudest), and not knowing who this person is, and not having had a reason to think about 3DES in quite a long time. What you're reading as snark or lawyering is, rather, me meaning exactly what I said, and being uncertain about what that person was talking about.
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.
It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context.
There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable making the same claim for C++.
I'm not a cryptographer but to me "broken" seems to imply that the core algorithm itself can be attacked. If merely applying it in certain ways as part of some larger system can fail then aren't most (possibly all) ciphers broken? It's entirely possible to do all sorts of stupid things.
Granted, a 2^32 block limit is pretty severe by modern standards.
Si (2^32)*8 works out to 34GB for TDES. How many applications involve encrypting that much data in one go?
Sorry, calling that a block limit was an error by omission on my part. 2^32 yields a 50% chance of reuse. If we pick a sane security margin it's a lot smaller. Assuming I did the math correctly just now, 2^-32 only gives you ~2^17 blocks; dropping that to 2^-24 yields ~2^21 blocks.
Off the top of my head, NIST was suggesting something like 8GB as the working limit. It would depend on your risk tolerance and the application in practice I guess. For something like video you might not really care about exposing a few 8 byte blocks here and there where the exposure is one block XORed with the other.
An aside, personally I quite like TDES for the purpose of generating secure handles and the like. The larger block sizes of pretty much every other common algorithm yield URLs and integers that are more difficult to work with. 64 bits is a manageable enough length and you don't have to implement the algorithm yourself (at which point you'd have rolled your own crypto).
This semantic argument was more plausible before the original commenter claimed 3DES can be "broken with little effort".
That's fair, I won't defend "broken with little effort".
Not to be rude, but it seems to me that you are engaging in some hairsplitting. In general, security people do not recommend to use 3DES or RC4 - even if RC4 is broken in other ways than 3DES.
RC4 is actually broken. It's fundamentally broken. As you run it, it's face melts off like the guy at the end of Raiders. It's genuinely weird nobody noticed how bad it was, in a practical sense, until the late aughts.
The 64 bit block size in 3DES (and Blowfish and IDEA) limits how much data you can encrypt under a single key. I think the real "tell" that this isn't hair-splitting is that people don't ever generally talk about Blowfish being "broken", just obsoleted.
People just don’t talk about Blowfish.
They do, but indirectly, the b in bcrypt stands for blowfish.
to any non-cryptographer, i think that's a distinction without a difference. it's disallowed from use by the major standards institute due to a vulnerability where people can recover the plain text.
that sounds "broken" to me, but i'm not a cryptographer. so, i'll defer to you when you say it's not broken. (i dont know what the cryptographer-specific definition of broken is -- it'd be great if you would shed some light on that)
Again: not a vulnerability in the cipher.
[dead]