My favourite SAML horror story, is that it used to be, that by default the main c implementation of xmlsig would not just check the sig with the public key specified but would also:
- check it against an hmac using a password specified in the attacker controlled document.
- check the signature using web pki (so the attacker could sign the saml document with their TLS key for their own personal domain and it would always be considered valid)
I honestly dont know how sites with saml arent getting hacked all the time. The only thing worse than the absolute terrible standards are the absolute terrible implementations.
I saw multiple implementations that looked for a signature, verified it, then just trusted the document as a whole rather than only the part that was signed. So as long as you had any signed SAML doc, you could provide an attention of your choosing and just bundle the signed one somewhere arbitrary inside of it.
I say this a lot, but: there was a conspiracy theory that NSA had infiltrated the IETF during the original IPSEC standardization effort and injected the "TLS BEAST" CBC IV chaining vulnerability, which is funny because we actually know exactly how that happened (professional academic cryptographers took out a petition to get the bug fixed and were shouted down by standards body gadflies who literally rejected the premise that there was such a thing as a professional academic cryptographer). This is really easy to see once you've done an engagement on DSIG security! Standards bodies are more than capable of fucking things up entirely on their own. If anything, NSA would risk making protocols stronger by intervening in their natural processes.
"Never attribute to malice what is adequately explained by stupidity". Or, in this case, design-by-committee by a bunch of people who haven't written ten lines of code in as many years. There have been several other cases where absolute no-brainer fixes, like one or two lines of code changed, to long-standing security problems, were filibustered, or blocked by WG chairs, for no explainable reason, and they can't all have been paid by the NSA to do that.
Yes, absolutely. And it's self-selection for mediocrity, people who are useless at any other task and prepared to argue endlessly over pointless technicalities that no-one apart from other professional meeting-goers care about are perfect for dumping onto standards committees.
bawolff · · focus · HN ↗
- check it against an hmac using a password specified in the attacker controlled document.
- check the signature using web pki (so the attacker could sign the saml document with their TLS key for their own personal domain and it would always be considered valid)
I honestly dont know how sites with saml arent getting hacked all the time. The only thing worse than the absolute terrible standards are the absolute terrible implementations.
stouset · · focus · HN ↗
tptacek · · focus · HN ↗
pseudohadamard · · focus · HN ↗
tptacek · · focus · HN ↗
pseudohadamard · · focus · HN ↗
bigfatkitten · · focus · HN ↗
They don’t build products, they don’t operate networks, and they don’t talk to customers.
pseudohadamard · · focus · HN ↗
bigfatkitten · · focus · HN ↗
HAIPE IS is classified, and mostly accommodates NSA’s private algorithms and key management practices.
IPMEIR is public, but it mandated the Suite B cipher suites and so I don’t know where it stands now with the move to PQC.