Bar mitzvah attack

The bar mitzvah attack is an attack on the SSL/TLS protocols that exploits the use of the RC4 cipher with weak keys for that cipher.^[1][2] While this affects only the first hundred or so bytes of only the very small fraction of connections that happen to use weak keys, it allows significant compromise of user security, for example by allowing the interception of password information^[2] which could then be used for long-term exploitation.

The attack uses a vulnerability in RC4 described as the invariance weakness by Fluhrer et al. in their 2001 paper on RC4 weaknesses.^[2][3]

The attack is named after the bar mitzvah ceremony which is held at 13 years of age, because the vulnerability exploited is 13 years old.^[1]

See also

• Fluhrer, Mantin and Shamir attack

References

1. Kelly Jackson Higgins (26 March 2015). "SSL/TLS Suffers 'Bar Mitzvah Attack'". Dark Reading.
2. Dan Goodin (27 March 2015). "Noose around Internet’s TLS system tightens with 2 new decryption attacks". Ars Technica.
3. Fluhrer, S., Mantin, I., and A. Shamir, "Weaknesses in the Key Scheduling Algorithm of RC4", Selected Areas of Cryptography: SAC 2001, Lecture Notes in Computer Science Vol. 2259, pp 1–24, 2001.

External links

• "Attacking SSL when using RC4: Breaking SSL with a 13-year-old RC4 Weakness" (PDF). Imperva. 2015. Retrieved 27 March 2015.