Уязвимости и бэкдоры в криптографических алгоритмах и ПО

Уровень 0 · материалов: 4

В кластер входят документы, описывающие технические недостатки, намеренные уязвимости или обманчивые заявления в средствах шифрования и защиты данных.

Общие признаки: анализ криптографических уязвимостей, наличие скрытых бэкдоров, несоответствие заявленной безопасности реальной реализации, критика алгоритмов шифрования

Группа выше: Реализация криптографии и её компрометация

Материалы

• #3932 — Analysis of the Kuznyechik Cipher S-Box and its Structure — Представитель этого кластера

  Про ГОСТовский шифр Кузнечик, его SBox и потерянные сиды — Scratch

  Смысл: The main idea is that the Kuznyechik cipher's S-Box exhibits an unexpected mathematical structure that contradicts the authors' claims of a random search. This discrepancy, combined with the loss of generation seeds, suggests a lack of transparency and raises suspicions about potential hidden vulnerabilities or backdoors.

  The author argues that the Kuznyechik cipher's S-Box is too structured to be random, contradicting official claims and raising security concerns.

• #25699 — Anomalies in GOST Kuznyechik and Streebog Algorithms

  Очередные странности в алгоритмах ГОСТ Кузнечик и Стрибог — Scratch

  Смысл: The main idea is that the Russian GOST cryptographic algorithms Kuznyechik and Streebog likely contain intentional backdoors (NOBUS) due to the non-random and secretive nature of their S-Box construction, which contradicts the official claims of the developers.

  Research suggests that Russian GOST algorithms Kuznyechik and Streebog may contain hidden 'NOBUS' backdoors because their supposedly random S-Boxes were actually created using a specific, non-transparent mathematical construction.

• #28151 — The Security Failure of NQ Vault Encryption

  Шифрование в NQ Vault оказалось обычным XOR-ом, и это еще не самое плохое — ComodoHacker

  Смысл: The text exposes the fraudulent security claims of the NQ Vault app, demonstrating that its 'encryption' is a trivial XOR operation affecting only the start of files, and warns users and reviewers against trusting security software based on popularity or appearance.

  NQ Vault's encryption is revealed to be a trivial single-byte XOR that only affects the first 128 bytes of a file, making it easily crackable.

• #23270 — Security Vulnerabilities in Signal Desktop Application

  Сверхзащищенный мессенджер Signal «тайно» сохраняет историю и ключи шифрования открытым текстом — Jeditobe

  Смысл: The main idea is that while Signal provides strong end-to-end encryption for messages in transit, its desktop application suffered from severe local security failures that exposed private data in plain text on the user's hard drive.

  Researchers discovered that Signal Desktop leaked private messages and encryption keys in plain text on local disks and failed to delete 'disappearing' media.