One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography
Tibor Jager, Kenneth G. Paterson, Juraj Somorovsky · 2013
Backwards compatibility attacks are based on the common practical scenario that a cryptographic standard offers a choice between several algorithms to perform the same cryptographic task. This often includes secure stateof-the-art cryptosystems, as well as insecure legacy cryptosystems with known vulnerabilities that are made available for backwards compatibility reasons. Obviously using insecure legacy cryptosystems is dangerous. However, we show the less obvious fact that even if users have the best of intentions to use only the most upto-date, vulnerability-free version of a system, the mere existence of support for old versions can have a catastrophic effect on security. We demonstrate the practical relevance of our results by describing attacks on current versions of important cryptographic Web standards: W3C XML Encryption and XML Signature, and JSON Web Encryption and Web Signature. We furthermore propose practical and effective countermeasures thwarting backwards compatibility attacks. These can be applied in new versions of these standards as well as in related specifications applying cryptographic primitives. ∗This author was supported by EPSRC Leadership Fellowship EP/H005455/1 †This author was supported by the Sec2 project of the German Federal Ministry of Education and Research (BMBF, FKZ: 01BY1030)