MS Office encryption flaw uncovered

[Renew Deal]

Flaw is believed to affect all current versions of Office

By John E. Dunn, Techworld.com
January 19, 2005

A researcher has uncovered what is claimed to be a “serious” flaw in the way Microsoft (Profile, Products, Articles) implements document encryption in Word and Excel.

The problem relates to the way Microsoft implements the 128-bit RC4 encryption algorithm when re-saving documents after their initial creation. In this situation it appears that the programs use the same password key and initialization vectors to encrypt different versions of the same document. Normally where the same password key is being used, different vectors should be used.

The problem emerged from detailed investigation by Hongjun Wu of the Institute of Infocomm Research in Singapore and has been dissected by him in a new paper, “The Misuse of RC4 in Microsoft Word and Excel”.

The flaw, which is believed to affect all current versions of the Office programs named, sounds highly technical but Wu describes a number of everyday scenarios where it would seriously undermine document security. One likely compromise was where two co-workers edited successive versions of a document where the password remained constant.
<snip>

http://www.infoworld.com/article/05/01/19/HNmsofficeflaw_1.html?source=NLC-TB2005-01-19

[WannaJumpMyScooter]

1. Security and Micro$oft in the same sentance? And this suprises, us

how?

[Renew Deal]

2. A followup

CRYPTO EXPERT: MICROSOFT WORD, EXCEL FLAW IS SERIOUS

Cryptography expert Phil Zimmermann has said he believes the flaw discovered in Microsoft's Word and Excel encryption is serious and warrants immediate attention.

http://newsletter.infoworld.com/t?ctl=B38F56:1F5CC8F