full-disclosure - NSRG-Security SaS Encryption cracked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200310151644.h9FGiw5H008749@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: NSRG-Security SaS Encryption cracked 

On Wed, 15 Oct 2003 01:55:10 CDT, Paul Tinsley <pdt@...khammer.org>  said:

>     full-disclosure it inspired me to audit a few websites myself.  I started
>     with the author of all the IMHO frivolous postings and found that he
>     "encrypted" his website with something called SaS that his group wrote.

Since the transmitted HTML needs to be (eventually) interpreted as HTML, there
are only two basic options:

1) Settle for mere obfuscation and a snippet of reverse-engineerable Javascript
or similar that decodes the obfuscated input to HTML that the browser will
accept.

2) Use a public-key or shared-secret system wherein each client gets a
potentially different version of the page (note that this includes the case of
an HTTP authentication failing and giving you an error page).

Again, to repeat - without some sort of per-client unique key, all you can do
is obfuscate, and said obfuscation has to be done in a programmable reversible
way to be at all useful.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031015/51d62b63/attachment.bin