Interesting AES Article

Julian · **Joined:** Thu Nov 27, 2008 5:48 pm **Posts:** 153

I wasn't sure whether to post this in the "Off Topic" sub-forum but it does relate to AES, which is what LastPass uses, so I thought I'd put it here.

My post is definitely intended to be for interest though, not a complaint or attempt at a scare that LastPass is using unsecure technology, because even the cryptographer quoted (Bruce Schneier) says that this new exploit is strong enough to be "almost practical" (i.e. not actually practical) but it's still somewhat interesting.

One quote from the article is: "One technique against the 11-round version of the cipher can be completed in 2^70 operations" I doubt that anyone short of the NSA has much chance of completing 2^70 operations in any sensible time but what is this "11-round version"? What version of AES (how many rounds) does LastPass use?

Here's the article: http://www.theregister.co.uk/2009/08/03 ... to_attack/

- Julian

JoeSiegrist · **Joined:** Wed Aug 20, 2008 10:40 am **Posts:** 3374

It's definitely looks like an interesting attack, though doesn't look to be in any way practical for use against your data stored in LastPass:

from article wrote:

Related-key attacks require a message to be encrypted with one key that is later changed to one or more different keys. It's usually hard for an outsider to control what keys get used, so the technique is considered hard to carry out under real-world settings.

Bruce Schneier wrote:

There are three reasons not to panic:
- The attack exploits the fact that the key schedule for 256-bit version is pretty lousy -- something we pointed out in our 2000 paper -- but doesn't extend to AES with a 128-bit key.
- It's a related-key attack, which requires the cryptanalyst to have access to plaintexts encrypted with multiple keys that are related in a specific way.
- The attack only breaks 11 rounds of AES-256. Full AES-256 has 14 rounds.

Your key only changes when you change your email/master password... and since SHA-256 is used to create the key your key won't be related. It is definitely surprising that this only impacts the 256-bit key version of AES (which is what LastPass uses), but also LastPass doesn't don't know the plain text, and LastPass is using all 14 rounds of AES which isn't impacted.

Joe

benphane · **Joined:** Tue Mar 10, 2009 2:59 am **Posts:** 19

Thanks for the detailed response. Saved me from a ton of googling that I would never get to. As indicated in the initial post, this isn't even a slightly real world threat. With regard to lastpass, it seems one would have to have lost their entire computing environment along with some extensive data history that shouldn't even exist. In such a case, lastpass would probably be the least worrisome thing going on.

Username		Log me on automatically each visit
Password

Interesting AES Article

Interesting AES Article

Who is online