Please create an account to participate in the Slashdot moderation system


Forgot your password?
Take advantage of Black Friday with 15% off sitewide with coupon code "BLACKFRIDAY" on Slashdot Deals (some exclusions apply)". ×

Submission + - XML Encryption Broken, Need to Fix W3C Standard (

gzipped_tar writes: Researchers from Ruhr University Bochum demonstrated the insecurity of XML encryption standard at ACM Conference on Computer and Communications Security in Chicago this week. "Everything is insecure", is the uncomfortable message from Bochum.

As pointed out by the Ars Technica article, XML Encryption is used widely as part of server-to-server Web services connections to transmit secure information mixed with non-sensitive data, based on cipher-block chaining. But it is apparently too weak, as demonstrated by Juraj Somorovsky and Tibor Jager. They were able to decrypt data by sending modified ciphertexts to the serve by gathering information from the received error messages. The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure — in all cases the result was the same: the attack worked.

Fixing the vulnerability will require a revision of the W3C XML encryption standard, Somorovsky said. The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process.

This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

XML Encryption Broken, Need to Fix W3C Standard

Comments Filter:

Numeric stability is probably not all that important when you're guessing.