新的 RC4 攻擊:實戰化

Twitter 上看到對 RC4 的新攻擊,可以直接攻擊 TLS 與 WPA-TKIP,沒有 workaround:「All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS」。

TKIP 可以在一個小時內打下來:

In practice the attack can be executed within an hour.

對於 TLS 則是 75 個小時有 94% 成功率,實際測試時只用了 52 個小時就順利攻下來:

We also attack TLS as used by HTTPS, where we show how to decrypt a secure cookie with a success rate of 94% using 9·227 ciphertexts. This is done by injecting known data around the cookie, abusing this using Mantin's ABSAB bias, and brute-forcing the cookie by traversing the plain-text candidates. Using our traffic generation technique, we are able to execute the attack in merely 75 hours.

When we tested the attack against real devices, it took merely 52 hours to successfully perform the attack.

看起來唯一的解法是停用...

One thought on “新的 RC4 攻擊:實戰化”

  1. 只要還是有用 SSL3 的需求,RC4 還是比 CBC 的 Oracle 問題強度好!

Leave a Reply

Your email address will not be published. Required fields are marked *