OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   Re: [xml-dev] The sky is falling! XML's dirty secret! Go back! It's a tr

[ Lists Home | Date Index | Thread Index ]

> 5/30/2002 6:05:50 PM, "Bullard, Claude L (Len)" <clbullar@ingr.com> wrote:
> >Someone who understands encryption would have to answer that. 
> >The article is not that informative but it is an interesting 
> >question.
> I don't know much about encryption, but from reading about
> cryptanalysis in WWWII it would appear that having a "crib"
> (a bit of known plaintext) is a useful shortcut to breaking a cipher.
> The tags in an XML message are likely to be known (or easily
> guessable) by an attacker.  So, a straightforward encryption of
> an entire XML message might be considerably less secure than
> an encryption of a non-self-describing message.  

I'm no crypto honcho either, but from my lay understanding, modern cryptographically strong hashing renders such approaches pretty much useless.   Knowing that the phrase "hello" appears somewhere in the plaintext has such an infinitesimal effect on the search space these days that you'd be better off dumpster diving.  Knowing all the XML tags used in the plaintext would also provide but infinitesimal advantage.

As your reading illustrates, this wasn't always the case: SHA and MD5 are recent inventions.

Now I'll shut up and wait for the crypto wizards to wake up and disabuse us all of our innumerate notions.

Uche Ogbuji                                    Fourthought, Inc.
http://uche.ogbuji.net    http://4Suite.org    http://fourthought.com
Track chair, XML/Web Services One (San Jose, Boston): http://www.xmlconference.com/
DAML Reference - http://www.xml.com/pub/a/2002/05/01/damlref.html
The Languages of the Semantic Web - http://www.newarchitectmag.com/documents/s=2453/new1020218556549/index.html
XML, The Model Driven Architecture, and RDF @ XML Europe - http://www.xmleurope.com/2002/kttrack.asp#themodel


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS