1. The Misuse of RC4 in Microsoft Office A paper by: Hongjun Wu Institute for Infocomm Research, Singapore ECE 578 Matthew Fleming

2. Microsoft Office Overview Microsoft Office –Released in 1989 –Encryption added in 1995 Encryption Schema –Default: 40-bit RC4 Due to cipher export regulations –Allows up to 128-bit RC4 cipher

3. RC4 Overview RC4 –Stream cipher –Variable sized key 8 to 2048 bits Multiples of 8 bits –XOR’s values of state to input –Shuffles state with every output

4. RC4 Overview RC4 Cryptanalysis –XOR is a weak operation –Security depends entirely on the randomness of the state vector –States are pseudo-random They will repeat with time

5. RC4 Overview RC4 Cryptanalysis –Knowing the entire state at a given time allows knowledge of all future values –Knowing the entire initial state effectively breaks the cipher –Initial state depends only upon the key –The key uniquely determines the keystream

6. RC4 in Microsoft Office

7. Document Encryption in Office –Password protected by the user Key generated from password –Initialization vector generated by Office –Key and initialization vector hashed together to create RC4 secret key

8. RC4 in Microsoft Office Initialization Vector –Generated only once for a given document The same initialization vector is used for a document, regardless of any editing User Password Behavior –Users rarely change passwords for a given document

9. RC4 in Microsoft Office RC4 Secret Key –Secret key generated from initialization vector and user password Initialization vector never changes Typically users never change the password on a given document –This means the same secret key is used in every edition of a document!

10. Attacks on Office Cryptosystems

11. Brute Force Attack –Only 40-bit to 128-bit encryption used Brute force attack the key Alternate Attack –Obtain different editions of a document Both will use the same initial keystream

12. Attacks on Office Cryptosystems Alternate Attack –Original –Original (Encrypted) Alternate Attack –Modified (Encrypted)

13. Attacks on Office Cryptosystems Alternate Attack –Original (Encrypted) –Modified (Encrypted)

14. Attacks on Office Cryptosystems Alternate Attack –Further exploits ASCII characters all have a leading zero –Perform analysis on XOR result of two documents See: “Automated cryptanalysis of XOR plaintext strings” [3]

15. Making Office More Secure

16. Simple Changes –A quick patch to prevent this attack Generate a new initialization vector after each edit –Use HMAC with the user password as the key and the document as the message –Generate the initialization vector from a random source, such as time (to the millisecond), clock cycles since program launch, etc.

17. Making Office More Secure Simple Changes –Switch to a block cipher AES IDEA –Use CBC (or similar) Even if the same initialization vector is used, it is difficult to extract information with CBC

18. Conclusions Office Misuses RC4 Cipher –Initialization vector remains the same across edits –40-bit encryption is woefully insecure against brute force attacks –RC4 is not a very strong cipher anyway

19. Conclusions Proposals for Better Security –Release a quick patch to implement HMAC for initialization vector generation –Upgrade the cryptosystems to use a block cipher (AES) with CBC Make this default

20. Questions?

22. References [1]H. Wu. The Misuse of RC4 in Microsoft Word and Excel. Institute for Infocomm Research, Singapore, January 2005. [2]R. Wash. Lecture Notes on Stream Ciphers and RC4. Case Western Reserve University. [3]E. Dawson and L. Nielsen. Automated cryptanalysis of XOR plaintext strings. Cryptologia, (2):165-181, April 1996.