AppSec EU 2017 On The (In-)Security Of JavaScript Object Signing And Encryption by Dennis Detering

JavaScript Object Signing and Encryption (JOSE) has been standardized as a lightweight alternative to XML Signature and Encryption. It has early been integrated in authentication and authorization protocols like OpenID Connect and OAuth. In addition, it has been adopted in Web services. In our research, we provide the first study regarding the JSON security adapting and extending known attack techniques. We provide an evaluation of four different libraries revealing critical cryptographic attacks, ranging from attacks bypassing JSON Signature (Signature exclusion, Key Confusion, and Timing Attack on HMAC), to JSON Encryption (Bleichenbacher Million Message Attack). To facilitate the analysis we developed JOSEPH - the first open-source automated tool for evaluating JSON security. The extensible design of JOSEPH allows one to implement further cryptographic attacks, for example, padding oracle or invalid curve attacks. - Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP...