[thinkzig]

Who's writing recommendations that say "switching ciphers fixes the problem"?

Visual Studio Magazine [1].

I've enjoyed reading all your comments on this thread. You clearly know your stuff. Based upon what you've seen so far and what you know about the ASP.NET framework, do you see any way around this short of some patch from Microsoft?

[1] - http://visualstudiomagazine.com/articles/2010/09/14/aspnet-s...

[tptacek]

The funny part about this story is that Thai's video (of him breaking DotNetNuke) breaks a 3DES key. The great thing about CBC padding and bitflips is that it's inherent to the block cipher mode; switch to DES-EDE, MARS, Twofish, or Serpent and you still have the same vulnerability. You don't even need to know how the algorithm is implemented! The same exploit will work, regardless of the underlying exploit.

You gotta love crypto.

[tptacek]

Underlying cipher, sorry.