Blog: XML Encryption Cracked, Exposing Real Threat to Online Transactions

XML Encryption Cracked, Exposing Real Threat to Online Transactions
Government Computer News (10/24/11) William Jackson

Ruhr-University Bochum researchers have demonstrated a technique for breaking the encryption used to secure data in online transactions, posing a serious threat on all currently used implementations of XML encryption. The attack can recover 160 bytes of a plain-text message in 10 seconds and decrypt larger amounts of data at the same pace, according to the researchers. The attack exploits weaknesses in the cipher-block chaining (CBC) mode of operation that is commonly used with many cryptographic algorithms, making it possible to also use the attack against non-XML implementations. "I would not be surprised to see variants of this attack applied to other protocols, when CBC mode is used in similar context," says the World Wide Web Consortium's (W3C's) Thomas Roessler. The researchers recommend fixing existing CBC implementations or developing secure new implementations without changing the XML Encryption standard. Roessler says such a change should be simple because the XML Encryption standard is not specific to any algorithm or mode of operation. He notes that W3C's XML Security Working Group is developing a set of mandatory algorithms used in XML Encryption to include use of only non-CBC modes of operation.

View Full Article

Blog: W3C Launches XProc Spec

W3C Launches XProc Spec
eWeek (05/11/10) Taft, Darryl K.

The World Wide Web Consortium (W3C) has released XProc, an Extensible Markup Language (XML) pipeline specification for managing XML-rich processes. W3C says the specification "provides a standard framework for composing XML processes [and] streamlines the automation, sequencing, and management of complex computations involving XML." XML is used throughout enterprise computing environments because it provides a standard way to manipulate data. "What we haven't had is any standard way to describe how to combine [XML functions] to accomplish any particular task," says XProc specification co-editor Mark Logic. "That's what XProc provides." University of Edinburgh reader Henry Thomas says "XProc exemplifies what W3C does best: We looked at existing practice--people have been using a number of similar-but-different XML-based languages--and we produced a consensus standard, creating interoperability and critical mass." W3C notes that XProc features a test suite that covers all of the required and optional steps of the language as well as all the static and dynamic errors.

View Full Article

Blog: XML Library Flaws Affect Numerous Applications

XML Library Flaws Affect Numerous Applications

SANS NewsBites Vol. 11 Num. 62 (August 6, 2009)

Researchers have uncovered a significant number of flaws in Extensible Markup Language (XML) libraries that could be exploited to crash machines and execute malicious code. The flaws affect large numbers of applications that use the libraries in question. Sun Microsystems, Apache, and Python products are known to be vulnerable.

http://www.securecomputing.net.au/News/152193,researchers-find-largescale-xml-library-flaws.aspx

http://www.theregister.co.uk/2009/08/06/xml_flaws/

http://voices.washingtonpost.com/securityfix/2009/08/researchers_xml_security_flaw.html

[Editor's Note (Northcutt): Uh Oh. This is not good. XML is behind the scenes in almost everything. I wonder whether XML gateways could be used to mitigate the problem to some extent.]

Blog: Standardization of Rule Based Technologies Moving Forward to Enable the Next Generation Web

Standardization of Rule Based Technologies Moving Forward to Enable the Next Generation Web
Pressemitteilung Web Service (06/11/2008)

RuleML is following up its first industry-oriented gathering last year with the International RuleML Symposium on Rule Interchange and Applications (RuleML-2008). This year's event is scheduled for Oct. 30-31 at the Buena Vista Palace in the Walt Disney World Resort in Orlando, Fla., and will give business and technology professionals, researchers, and standardization representatives another opportunity to focus on the increasing performance and applicability of rule technologies. The international umbrella organization for Web rule research, standardization, and adoption will make every topic related to rules a focus of the symposium, from engineering and use of rule-based systems, the integration of rules and other Web technologies, languages and frameworks for rule representation and processing, rule-related web standards, to the interoperation of rule-based systems and the incorporation of rule technology into enterprise architectures. RuleML-2008 will offer peer-reviewed paper presentations, invited talks, software demonstrations, and social events. There will be a challenge session that gives participants the opportunity to show their commercial and open source tools, use cases, and applications, and to win prizes for best applications. The symposium will be co-located with the Business Rules Forum to bring greater attention to the connection between rule and business logic technologies. ACM is among the sponsors and partner organizations that support RuleML-2008.
Click Here to View Full Article