German researchers break W3C XML encryption standard

Oct 19, 2011

Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure", is the uncomfortable message from Ruhr-University Bochum researchers.

XML stands for "eXtensible Markup Language", and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.

Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. "We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages." The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure – in all cases the result was the same: the attack works, XML Encryption is not secure. Details of the attack are presented at this year's ACM Conference on Computer and Communications Security.

"There is no simple patch for this problem", states Somorovsky. "We therefore propose to change the standard as soon as possible." The researchers informed all possibly affected companies through the mailing list of , following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.

Explore further: Researcher develops method for monitoring whether private information is sufficiently protected

Provided by Ruhr-University Bochum

5 /5 (2 votes)

Related Stories

Microsoft backs cross-platform initiative

Jul 06, 2006

Microsoft announced Thursday it will sponsor with its partners an Open Translator project between Microsoft Office Open XML Formats and the Open Document Format (ODF).

Microsoft to appeal Word patent ruling

Aug 12, 2009

Microsoft said Wednesday it plans to appeal a ruling by a Texas judge that would ban the US software giant from selling its popular Word program in the United States.

Sensoring the World Wide Web

Apr 15, 2009

CSIRO scientists will lead an international initiative to develop standards for sharing information collected by sensors and sensor networks over the Internet.

Recommended for you

Tackling urban problems with Big Data

14 hours ago

Paul Waddell, a city planning professor at the University of California, Berkeley, with a penchant for conducting research with what he calls his "big urban data," is putting his work to a real-world test ...

Computer-assisted accelerator design

Apr 22, 2014

Stephen Brooks uses his own custom software tool to fire electron beams into a virtual model of proposed accelerator designs for eRHIC. The goal: Keep the cost down and be sure the beams will circulate in ...

User comments : 0

More news stories

Genetic code of the deadly tsetse fly unraveled

Mining the genome of the disease-transmitting tsetse fly, researchers have revealed the genetic adaptions that allow it to have such unique biology and transmit disease to both humans and animals.

Ocean microbes display remarkable genetic diversity

The smallest, most abundant marine microbe, Prochlorococcus, is a photosynthetic bacteria species essential to the marine ecosystem. An estimated billion billion billion of the single-cell creatures live i ...