The bar mitzvah attack is an attack on the SSL/TLS protocols that exploits the use of the RC4 cipher with weak keys for that cipher. While the attack affects only the first hundred or so bytes of only the very small fraction of connections that happen to use weak keys, it allows significant compromise of user security, for example by allowing the interception of password information which could then be used for long-term exploitation. The attack uses a vulnerability in RC4 described as the invariance weakness by Fluhrer et al. in their 2001 paper on RC4 weaknesses. This vulnerability became known as the FMS attack, after the initials of the authors. The attack is named after the bar mitzvah ceremony held at 13 years of age, because the underlying vulnerability was 13 years old at the time the exploit was first described. The name was likely inspired by the unrelated birthday attack.
See also Fluhrer, Mantin and Shamir attack
References
External links "Attacking SSL when using RC4: Breaking SSL with a 13-year-old RC4 Weakness" (PDF). Imperva. 2015. Retrieved 27 March 2015. "Bar Mitzvah Attack Breaking SSL with a 13-year old RC4 Weakness (Slides)" (PDF). Black Hat Asia. 2015. Retrieved 7 October 2020. "Bar Mitzvah Attack Breaking SSL with a 13-year old RC4 Weakness (Whitepaper)" (PDF). Black Hat Asia. 2015. Retrieved 7 October 2020.