|
|
| Line 1: |
Line 1: |
| In cryptography, a '''watermarking attack''' is an attack on [[disk encryption]] methods where the presence of a specially crafted piece of data (e.g., a [[decoy]] file) can be detected by an attacker without knowing the encryption [[key (cryptography)|key]].
| | I would like to introduce myself to you, I am Andrew and my wife doesn't like it at all. Ohio is where his home is and his family members enjoys it. My day occupation is an invoicing officer but I've already utilized for an additional 1. What me and my family adore is to climb but I'm thinking on starting something new.<br><br>Review my blog post; [http://www.octionx.sinfauganda.co.ug/node/22469 love psychic] |
| | |
| ==Problem description==
| |
| Disk encryption suites generally operate on data in 512-byte [[cylinder-head-sector|sector]]s which are individually encrypted and decrypted. These 512-byte sectors alone can use any [[block cipher mode of operation]] (typically [[Cipher Block Chaining|CBC]]), but since arbitrary sectors in the middle of the disk need to be accessible individually, they cannot depend on the contents of their preceding/succeeding sectors. Thus, with CBC, each sector has to have its own [[initialization vector]] (IV). If these IVs are predictable by an attacker (and the filesystem reliably starts file content at the same offset to the start of each sector, and files are likely to be largely contiguous), then there is a [[chosen plaintext attack]] which can reveal the existence of encrypted data, as follows. The problem is analogous to that of using block ciphers in the [[block cipher modes of operation#Electronic codebook (ECB)|electronic codebook (ECB)]] mode, but instead of whole blocks, only the first block in different sectors are identical. The problem can be relatively easily eliminated by making the IVs unpredictable with, for example, [[Disk encryption theory#Encrypted_salt-sector_initialization_vector_.28ESSIV.29|ESSIV]].<ref>
| |
| {{cite web
| |
| | last = Fruhwirth
| |
| | first = Clemens
| |
| | title = Linux hard disk encryption settings
| |
| | url = http://clemens.endorphin.org/LinuxHDEncSettings
| |
| | accessdate = 2006-01-02
| |
| }}</ref> Alternatively, one can use modes of operation specifically designed for disk encryption (see [[disk encryption theory]]). This weakness affected many [[disk encryption]] programs, including older versions of [[BestCrypt]]<ref name="bestcrypt-iv-flaw">
| |
| {{cite paper
| |
| | author = Chiriliuc, Adal
| |
| | title = BestCrypt IV generation flaw
| |
| | date = 2003-10-23
| |
| | url = http://adal.chiriliuc.com/bc_iv_flaw.php
| |
| | accessdate = 2006-08-23
| |
| }}</ref> as well as the now-deprecated [[cryptoloop]].<ref>
| |
| {{cite web
| |
| | last = Saarinen
| |
| | first = Markku-Juhani O.
| |
| | title = Linux for the Information Smuggler
| |
| | date = 2004-02-19
| |
| | publisher = Helsinki University of Technology
| |
| | url = http://mareichelt.de/pub/notmine/diskenc.pdf
| |
| | format = [[PDF]]
| |
| | accessdate = 2006-10-01
| |
| }}</ref>
| |
| | |
| To carry out the attack, a special plaintext file is created for encryption in the system under attack, such that the first ciphertext block in two or more sectors is identical. This requires that the input to the cipher (plaintext, <math>\scriptstyle P</math>, [[XOR]] initialisation vector, <math>\scriptstyle IV</math>) for each block must be the same; i.e., <math>\scriptstyle P_1 \,\oplus\, IV_1 \;=\; P_2 \,\oplus\, IV_2</math>. Thus, we must choose plaintexts, <math>\scriptstyle P_1,\, P_2</math> such that <math>\scriptstyle P_1 \,\oplus\, P_2 \;=\; IV_1 \,\oplus\, IV_2</math>. The ciphertext block patterns generated in this way give away the existence of the file, without any need for the disk to be decrypted first.
| |
| | |
| ==See also==
| |
| {{Portal|Cryptography}}
| |
| * [[Disk encryption theory]]
| |
| * [[Initialization vector]]
| |
| * [[Block cipher modes of operation]]
| |
| * [[Watermark]]
| |
| | |
| ==References==
| |
| {{Reflist}}
| |
| | |
| [[Category:Cryptographic attacks]]
| |
| [[Category:Disk encryption]]
| |
I would like to introduce myself to you, I am Andrew and my wife doesn't like it at all. Ohio is where his home is and his family members enjoys it. My day occupation is an invoicing officer but I've already utilized for an additional 1. What me and my family adore is to climb but I'm thinking on starting something new.
Review my blog post; love psychic