Why was the BEAST attack previously considered implausible?

Question

Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented since the very first version of SSL. Most people in the crypto and security community have concluded that it is non-exploitable' (http://threatpost.com/en_us/blogs/new-attack-breaks-confidentiality-model-ssl-allows-theft-encrypted-cookies-091911) and several other articles mentioned that the attack was previously though implausible but I don't know why.

Answer 1

The attack requires cooperation between an outer component (which can intercept traffic) and an inner component which runs on the attacked machine and is able to inject arbitrary data (chosen by the attacker) within the SSL tunnel, along with the piece of data which is to be decrypted. The general view among most people in the crypto and security communities is that when the attacker can do that, he has enough control on the attacked machine that he can be considered to have already won. A fix was nonetheless published in TLS 1.1 (published in 2006) and ulterior versions.

It so happens that with 2011's Internet, there can be a considerable amount of hostile code running on the user's system, through Java and/or Javascript, and such code has considerable power over what happens on said system. This is the kind of über-attacker that was envisioned and declared as "not plausible in practice" back in 2006. Note that BEAST is as yet unpublished except through some slides, so while it has run successfully in lab conditions, it is unclear whether it would be worth the effort to build it in the wild. After all, it seems that nobody ever bothered decrypting 40-bit SSL connections on a regular, industrial basis, despite the computational ease of doing so (that "nobody" is about attackers who are after credit card numbers and banking access passwords, not governmental security agencies -- if your country's secret service does not routinely decrypt 40-bit SSL, then you are entitled to question what the heck they do with your tax money).

One way to see it is that crypto and security researchers, and/or Web browser vendors, failed to envision the evolution of the Web architecture. Another way to see it is that browser vendors are hard at work building a Web structure which is, security-wise, doomed from start.

Answer 2

Previously, the attack was considered possible in principle but not a serious threat in practice. It was believed that the attack would require so much chosen plaintext that the attack was not a practical threat. In addition, in the web setting, there was no known way to get the victim's browser to encrypt the chosen plaintext with the necessary level of control (it was known how to do it in a VPN setting, but not for a victim who is using web browser to browse the web). Therefore, the attack was believed to be of limited relevance in the real world.

Obviously, this belief had some holes in it. As Bruce Schneier writes, "attacks always get better". In other words, just because today an attack appears to require 2²⁰ chosen plaintexts, doesn't mean it will always be so -- people might in the future discover ways to reduce the amount of chosen plaintext required.

I can sympathize with an argument that, in retrospect, the community should have taken the attack more seriously. That said, hindsight is 20-20, so I wouldn't judge the community too harshly. Bottom line: these things happen. Our understanding grows over time.

Answer 3

The exploit was only considered theoretical, so all big browser vendors simply chose to ignore it. Anyway, as far as I know , the paper is still not released, but some people in the crypto community seem to have understood the attack.