[jgroups-users] Impact of Security Alert JGRP-2021 on Symmetric Encryption

Hi,

We use Jgroups 3.4.3. We are planning to use symmetric encryption with encrypt_entire_message=true. Recently, I came across JGRP-2021 security vulnerability. I would appreciate if some Jgroup user could confirm following impact analysis so as to confirm my correct interpretation of the security vulnerability.

    Security Impact of JGRP-2021 on a System with Symmetric Encryption and encrypt_entire_message=true
    -----------------------------------------------------------------------------------------------------------------
   A. Even if I use symmetric encryption with encrypt_entire_message=true, A non-member could still send messages to existing nodes by not using ENCRYPT and AUTH .
   B. Replay attack is NOT possible because entire message is encrypted and a hacker cant get the seq no. (duplicates shall automatically be discarded)
   C. Because a non-member is able to send message to existing nodes, a new view (including non-member) could be installed on existing nodes. Thus, a non-member  would start receiving encrypted messages from nodes but completed encrypted messages wont be of any use, unless the new node possesses the secret key. So, no issues.
   D. As per https://access.redhat.com/articles/2360521, a remote attacker could execute arbitrary code on a Java Virtual Machine running JGroups. This is possible because security is bypassed.


Also, I think Asymmetric encryption is better than symmetric encryption because: In Asymmetric communication, New symmetric key is generated for each view change. Thus, a symmetric key which was leaked earlier cant be misused. At the same time, asymmetric encryption can create problems if AUTH is weak. Any recommendation on the type of AUTH tokens and Encryption type?

Thanks
Anuj
  

------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned
dictionary content that is easy and intuitive to access. Sign up for an
account today to start using our lexical data to power your apps and
projects. Get started today and enter our developer competition.
http://sdm.link/oxford

_______________________________________________
javagroups-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/javagroups-users