The bar mitzvah attack is an attack on the SSL/TLS protocols that exploits the use of the RC4 cipher with weak keys for that cipher.[1][2] While this affects only the first hundred or so bytes of only the very small fraction of connections that happen to use weak keys, it allows significant compromise of user security, for example by allowing the interception of password information[2] which could then be used for long-term exploitation.
The attack uses a vulnerability in RC4 described as the invariance weakness by Fluhrer et al. in their 2001 paper on RC4 weaknesses, also known as the FMS attack.[2][3]
The attack is named after the bar mitzvah ceremony which is held at 13 years of age, because the vulnerability exploited is 13 years old[1] and likely inspired by the naming of the unrelated birthday attack.
See also edit
References edit
- ^ a b Kelly Jackson Higgins (26 March 2015). "SSL/TLS Suffers 'Bar Mitzvah Attack'". Dark Reading.
- ^ a b c Dan Goodin (27 March 2015). "Noose around Internet's TLS system tightens with 2 new decryption attacks". Ars Technica.
- ^ Fluhrer, S., Mantin, I., and A. Shamir, "Weaknesses in the Key Scheduling Algorithm of RC4", Selected Areas of Cryptography: SAC 2001, Lecture Notes in Computer Science Vol. 2259, pp 1–24, 2001.
External links edit
- "Attacking SSL when using RC4: Breaking SSL with a 13-year-old RC4 Weakness" (PDF). Imperva. 2015. Retrieved 27 March 2015.
- "Bar Mitzvah Attack Breaking SSL with a 13-year old RC4 Weakness (Slides)" (PDF). Black Hat Asia. 2015. Retrieved 7 October 2020.
- "Bar Mitzvah Attack Breaking SSL with a 13-year old RC4 Weakness (Whitepaper)" (PDF). Black Hat Asia. 2015. Retrieved 7 October 2020.
 | This cryptography-related article is a stub. You can help Wikipedia by expanding it. |