Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server...

18
Transcript Collision Attacks: Breaking Authentication in TLS, IKE and SSH or: MD5 MUST DIE Karthikeyan Bhargavan Gaëtan Leurent http://sloth-attack.org

Transcript of Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server...

Page 1: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

TranscriptCollisionAttacks:BreakingAuthenticationinTLS,IKEandSSH

or: MD5MUSTDIE

Karthikeyan BhargavanGaëtan Leurent

http://sloth-attack.org

Page 2: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

Cryptoprotocolsandapplicationsevolve

Agility:gracefultransitionfromoldtonew

Whatcangowrong?

• Downgradeattacks:POODLE,LOGJAM,SLOTH

Page 3: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

AuthenticatedDHwithNegotiation

Version/Group/CipherParameters

SignedTranscript

Page 4: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

WhatTranscripttoSign?• Signthefullmessagetrace– sign(skB,hash(m1 |m2))– Example:TLS1.3,SSH-2,TLS1.2clientauth

• Signyourephemerals,MACthetranscript– sign(skB,hash(nonceA |nonceB |g|p|gy))– Example:TLS1.2serverauth

• SignyourownmessagesandMACed identity– sign(skA,hash(m1|mac(k,A)))– sign(skB,hash(m2|mac(k,B)))– Example:IKEv2initiator,responder,EAPauth

Page 5: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

UsingWeakHashFunctions

• Signthefulltranscript– sign(skB,hash(m1 |m2))– Example:TLS1.3,SSH-2,TLS1.2clientauth

• Howweakcanthehash functionbe?– doweneedcollisionresistance?– doweonlyneed2nd preimage resistance?– IsitstillsafetouseMD5,SHA-1inTLS,IKE,SSH?– Disagreement:cryptographersvs.practitioners

(seeSchneier vs.Hoffman,RFC4270)

Page 6: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

SLOTH:TranscriptCollisionAttacks

ServerImpersonation

ClientImpersonation

ParameterDowngrade

Man-in-the-Middle:networkattacker/maliciousserver

Page 7: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

ComputingaTranscriptCollision

hash(m1 |m’2) =hash(m’1 |m2)

• Weneedtocomputeacollision,notapreimage– Attackercontrolspartsofbothtranscripts– Ifweknowtheblackbits, canwecomputethered bits?– Thisisusuallycalledagenericcollision

• Ifwe’relucky,wecansetupashortcut collision– Common-prefix:collisionafterasharedtranscriptprefix– Chosen-prefix:collisionafterattacker-controlledprefixes

Page 8: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

PrimeronHashCollisionComplexity

• MD5:knownattackcomplexities– MD5secondpreimage 2128hashes– MD5 genericcollision: 264hashes

(birthday)– MD5chosen-prefixcollision: 239hashes (1hour)– MD5 common-prefixcollision: 216hashes (seconds)

• SHA1:estimatedattackcomplexities– SHA1secondpreimage 2160hashes– SHA1 genericcollision: 280 hashes

(birthday)– SHA1chosen-prefixcollision: 277 hashes (?)

Page 9: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

CompositeHashConstructions

• Whenusedastranscripthashfunctionsmanyconstructionsarenotcollisionresistant– MD5(x)|SHA1(x)notmuchbetterthanSHA1

– HMAC-MD5(k,x)notmuchbetterthanMD5

– HMAC-SHA256(k,MD5(x))notmuchbetterthanMD5

– TruncatedHMAC-SHA256(k,x)toNbitsnotmuchbetterthanaNbithashfunction

Page 10: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

hashhash

ComputingTranscriptCollisions

len1gx

paramsA

len1’gx’

params’A

len2gy

paramsB

len2’gy’

params’B

A BMitM

m1 m1’

m2m2’

Page 11: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

GenericTranscriptCollisions

len1gx

nonceA

len1’gx’

nonce1len2gstatic

nonceA

len2’gy’

nonce1

A BMitMhash hash

len2’gy’

nonce2

len1’gx’

nonce2

len1’gx’

nonceNlen2’gy’

nonceN

Predictable:StaticDHkey,nofreshnonce

Tryrandomnoncesuntilcollision

N=2|hash|/2MD5:264SHA-1:280

HMAC/96:248

Page 12: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

Chosen-PrefixTranscriptCollisions

len1gx

blobAlen2gy

blobB

A BMitM

Knownlength,ephemeralDHkey,arbitraryBLOB

m1

m2

Page 13: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

len1gx

blobA

len2gy

blobB

len2’gy’

C1

A BMitM

len1’gx’

00000000

0000000000000000

C2len2gy

blobB

hash hash

blobA’

blobB’

FindChosen-PrefixCollisionC1,C2

m1 m1’

m2m2’

Merkle-Damgardhashextension

N=2CPC(hash)MD5:239SHA-1:277

HMAC/96:n/a

Page 14: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

SLOTH:AttackingTLS1.2ClientAuth• TLS1.2upgradedhashfunctionsusedinTLS– SHA-256forallhandshakeconstructions– Newsignaturealgorithmsextension:SHA-256/384/512

• TLS1.2addedsupportforMD5-basedsignatures!– EveniftheclientandserverpreferRSA-SHA256,theconnectioncanbedowngradedtoRSA-MD5!

• TranscriptcollisionsbreakTLS1.2clientsignatures– Chosenprefixcollisionattackusingflexibleformats– Demo:Takes1hour/connectionona48-coreworkstation– Notverypractical:connectionmustbeliveduringattack

Page 15: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

SLOTH:AttackingTLSServerAuth

• TLS1.2serversignaturesarehardertobreak– Irony:theweaknessthatenablesLogjamblocksSLOTH– Needs2Xpriorconnections+2128-Xhashes/connection– Notpracticalforacademics,asfarasweknow

• TLS1.3serversignaturesispotentiallyvulnerable– New:MD5,SHA-1sigsnowexplicitlyforbiddeninTLS1.3

Page 16: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

OtherSLOTHVulnerabilities

• ReducedsecurityforTLS1.*,IKEv1,IKEv2,SSH– ImpersonationattackonTLSchannelbindings– Exploitdowngrades+transcriptcollisions– Theseareprotocolflaws,notimplementationbugs–Mainmitigationistodisableweakhashfunctions

Page 17: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

FinalThoughts

• Legacycryptoisstrangelyhardtogetridof,butwehavetokeeptryingtokillbrokenprimitives

(MD5MUSTDIE)• KeyexchangesinInternetprotocolsdo relyoncollisionresistance,questionanyonewhotellsyouotherwise!

• Future:newdowngraderesilientprotocols,collision-resistantauthenticationmechanisms

• Moredetails,papers,demosareat:http://sloth-attack.org

Page 18: Transcript Collision Attacks - NDSS Symposium · 2017-09-01 · – Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! • Transcript collisions

Tales from the Crypt: Safer Anonymization with SHA · SHA (Secure Hash Algorithm)? The SHA256 function converts a string, based on the SHA256 algorithm, to a 256-bit hash value This

Tales from the Crypt: Safer Anonymization with SHA · SHA (Secure Hash Algorithm)? The SHA256 function converts a string, based on the SHA256 algorithm, to a 256-bit hash value This

Introduction to Cryptography: RSA · RSA Description Fermat’s little Theorem (FlT) Fast Multiplication Euclidean Algorithm Implementing RSA Introduction to Cryptography: RSA Introduction

Introduction to Cryptography: RSA · RSA Description Fermat’s little Theorem (FlT) Fast Multiplication Euclidean Algorithm Implementing RSA Introduction to Cryptography: RSA Introduction

RSA®, The Security Division of EMC RSA Adaptive

RSA®, The Security Division of EMC RSA Adaptive

TrendLabs - Threat Encyclopedia...SHA256 Package Name App Label 75c2b6178390aa68f809ce 038270690558d4d958fd887a966a82c6b268fa5793 723592e2c4e0321f7f4960 com.barcodescannerto.vnm Barcode

TrendLabs - Threat Encyclopedia...SHA256 Package Name App Label 75c2b6178390aa68f809ce 038270690558d4d958fd887a966a82c6b268fa5793 723592e2c4e0321f7f4960 com.barcodescannerto.vnm Barcode

—02 : Transcript I Transcript 1 Transcript 2 Transcript 4 ...hbtu.ac.in/wp-content/uploads/2019/10/IMPORTANT-INSTRUCTION-F… · 1 Transcript 2 Transcript 4 (Marksheet) Transcript

—02 : Transcript I Transcript 1 Transcript 2 Transcript 4 ...hbtu.ac.in/wp-content/uploads/2019/10/IMPORTANT-INSTRUCTION-F… · 1 Transcript 2 Transcript 4 (Marksheet) Transcript

APIs documentation - Marginalen Bank Bank - APIs... · algorithm Specify which algorithm was used when generating the signature: rsa-sha512 or rsa-sha256. headers The list of headers

APIs documentation - Marginalen Bank Bank - APIs... · algorithm Specify which algorithm was used when generating the signature: rsa-sha512 or rsa-sha256. headers The list of headers

2020 CAREER DEVELOPMENT AWARDmedia.pancan.org/rsa/2020/2020-CDA-RFA-FINAL.pdf · as indicated on their diploma and/or transcript). ... • Not have currently or previously served

2020 CAREER DEVELOPMENT AWARDmedia.pancan.org/rsa/2020/2020-CDA-RFA-FINAL.pdf · as indicated on their diploma and/or transcript). ... • Not have currently or previously served

Protecting TLS from Legacy Crypto · 2016-09-02 · • Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! Transcript collisions break TLS

Protecting TLS from Legacy Crypto · 2016-09-02 · • Even if the client and server prefer RSA-SHA256, the connection can be downgraded to RSA-MD5! Transcript collisions break TLS

13 - The RSA - RSA

13 - The RSA - RSA

RSA ADVANCED SECURITY OPERATIONS CENTER · RSA Security Analytics RSA Advanced ... RSA SECURITY ANALYTICS ARCHITECTURE ... Intelligence feeds APT Domains Suspicious Proxies Malicious

RSA ADVANCED SECURITY OPERATIONS CENTER · RSA Security Analytics RSA Advanced ... RSA SECURITY ANALYTICS ARCHITECTURE ... Intelligence feeds APT Domains Suspicious Proxies Malicious

EMC PowerPath for Windows Installation Guide · l Beginning with the 6.1 release of PowerPath for Windows, all drivers are signed with SHA256 certificates. For SHA256-signed drivers

EMC PowerPath for Windows Installation Guide · l Beginning with the 6.1 release of PowerPath for Windows, all drivers are signed with SHA256 certificates. For SHA256-signed drivers

Hashing: SHA256 Tayler Angevine Bachelor of Arts Dr. Ken Blaha 3/13/2014

Hashing: SHA256 Tayler Angevine Bachelor of Arts Dr. Ken Blaha 3/13/2014

Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Optimising the SHA256 Hashing Algorithm for Faster & …nicolascourtois.com/bitcoin/Optimising the SHA256 Hashing Algorithm... · Satoshi Nakamoto (a pseudonym). Bitcoin depends on

Optimising the SHA256 Hashing Algorithm for Faster & …nicolascourtois.com/bitcoin/Optimising the SHA256 Hashing Algorithm... · Satoshi Nakamoto (a pseudonym). Bitcoin depends on

CONTENTSCisco Cisco logo logo N WebEX Cisco Cisco IT IT Yahoo MCafee AMD eBay Symantec Verisign Intel Logo IT. 12 RSA 2008 4 8 RSA RSA Marketing RSA RSA 2008 1 Web Email IM 2 3 4 RSA

CONTENTSCisco Cisco logo logo N WebEX Cisco Cisco IT IT Yahoo MCafee AMD eBay Symantec Verisign Intel Logo IT. 12 RSA 2008 4 8 RSA RSA Marketing RSA RSA 2008 1 Web Email IM 2 3 4 RSA

Transcript of Keynote Address at the RSA …...1 Transcript of Keynote Address at the RSA Conference 2017 “The Need for a Digital Geneva Convention” Brad Smith President Microsoft

Transcript of Keynote Address at the RSA …...1 Transcript of Keynote Address at the RSA Conference 2017 “The Need for a Digital Geneva Convention” Brad Smith President Microsoft

RSA/Edge Lecture: Changing Paradigms - How we …film-english.com/.../uploads/2010/12/transcript-sir-ken-robinson.pdf · RSA | RSA Edge Lecture: Changing Paradigms ... How we implement

RSA/Edge Lecture: Changing Paradigms - How we …film-english.com/.../uploads/2010/12/transcript-sir-ken-robinson.pdf · RSA | RSA Edge Lecture: Changing Paradigms ... How we implement

CRYPTANALYSE DE RSA - Abderrahmane Nitaj · Introduction `a RSA Cryptanalyse de RSA par les fractions continues Cryptanalyse de RSA par l’algorithme LLL Principes de RSA Cryptanalyses

CRYPTANALYSE DE RSA - Abderrahmane Nitaj · Introduction `a RSA Cryptanalyse de RSA par les fractions continues Cryptanalyse de RSA par l’algorithme LLL Principes de RSA Cryptanalyses

help.csod.com · Web viewTranscript: Transcript Overview. Transcript: Transcript: Transcript: Transcript Overview. Transcript: Transcript Overview. Transcript: Transcript Overview.

help.csod.com · Web viewTranscript: Transcript Overview. Transcript: Transcript: Transcript: Transcript Overview. Transcript: Transcript Overview. Transcript: Transcript Overview.

RSA, RSW, Hon RBA, MA(RCA) RSA RSW

RSA, RSW, Hon RBA, MA(RCA) RSA RSW