View
16
Download
2
Embed Size (px)
Citation preview
NOVEL SIDE CHANNELS IN POPULAR SSL/TLS IMPLEMENTATIONS BASED ON INSTRUCTION SET ARCHITECTURE
By : Vaishali Garg
1
PADDING ORACLE ATTACK
¢ Against CBC-mode encryption with PKCS#5 padding
¢ Oracle exists which on receipt of ciphertext, decrypts it & replies whether the padding is correct or not
¢ Using this oracle, data can be decrypted without knowing the key 3
Vaudenay’s Attack
May 2002
SIDE CHANNEL ATTACKS
¢ Information gained from physical implementation of a cryptosystem
� Through some observable attributes of an online communication
¢ Example : � Packet Arrival & Departure time or an error message � Packet Size � Power Usage
6
RESEARCH DIRECTION
¢ Side-channel attacks keep on reviving
¢ Such multiple side channels may exist
¢ To determine novel side channels in various open source SSL libraries such as OpenSSL and wolfSSL
7
PADDING ORACLE ATTACK
9
http://www.bank.com/login.php?message= b2a72189df804632a55a15d599a1693e6e62a997052847fd
b2a72189df804632
IV
a55a15d599a1693e
Block 1
6e62a997052847fd
Block 2
https://www.bank.com/login.php?message=transfer10x06x06x06x06x06x06
3-DES, AES, RSA etc.
PADDING ORACLE ATTACK
10
6e 62 a9 97 05 28 47 fd
Decrypt
??
?? ?? ?? ?? ?? ?? ?? 01
Intermediate block
Previous block
Plaintext block
IV
?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 00 00 00
??
Decrypt
Block 1 Block 2
Valid padding check
PADDING ORACLE ATTACK
11
Incorrect padding Correct padding
Response time - more Response time - less
Further decryption takes place
No Further decryption
6e 62 a9 97 05 28 47 fd
Decrypt
??
?? ?? ?? ?? ?? ?? ?? 01
Intermediate block
Previous block
Plaintext block
IV
?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 00 00 00
??
Decrypt
means, A XOR B = 0x01
?? XOR ?? = 01
PADDING ORACLE ATTACK
12
Block 1 Block 2 Brute force
¢ Brute Force the Last Byte – from 0x00-0xff
13
The Oracle
00 00 00 00 00 00 00
6e 62 a9 97 05 28 47 fd
00 C1
C2
64 32 1b b8 0a aa 08 39
P2
Incorrect padding, immediate server response
Error 404 : Server not found :(
The Oracle
00 00 00 00 00 00 00
6e 62 a9 97 05 28 47 fd
39 C1
C2
64 32 1b b8 0a aa 08 01
P2
Correct padding, server response takes some time
Error 404 : Server not found :(
01
39
PADDING ORACLE ATTACK
14
Server Response
Server Response Time
(same in all cases)
(different for valid padding case)
PADDING ORACLE ATTACK So, C2’ xor C1 = 0x01
C2’ xor 0x39 = 0x01 implies, C2’ = (0x39) xor (0x01)
C2’ = 0x38 (intermediate byte of C2) ---- (1)
6e 62 a9 97 05 28 47 fd
Decrypt
?? ?? ?? ?? ?? ?? ?? 01
IV
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
39
00 00 00 00 00 00 00
00 00 00 00 00 00 00 39
Decrypt
means, C2’ XOR C1 = 0x01
?? XOR 39 = 01
C1 = a55a15d599a1673e ---(2) C2 = 6e62a997052847fd
15
From CBC Decryption P2 = (Intermediate byte of C2) xor (C1) P2 = (0x38) xor (0x3e) P2 = 0x06
Hence, Plaintext is successfully obtained
C1 C2
Are these the only side channels? Or Can there be other instruction set architecture based side channels?
17
EXAMPLES ¢ Some instructions are executed more often for valid
padding
¢ Example : � CPU cycles � Memory Accesses
18
CONTRIBUTION
¢ Explored Novel Side Channels on OpenSSL & wolfSSL � Based on Instruction Set Architecture � Examples : CPU cycles, Memory Accesses etc.
¢ Successful decryption of cipher text using aforementioned side channels � Change in the value of the attributes � Clearly Observable for correct plaintext value � Decipher all bytes
19
OPENSSL � Full featured open source toolkit � Implements SSL(v2/v3) & TLS protocols(v1) � Support for various cryptographic functions � Used id Open Source Projects like TOR, IPSEC Tools, APT package
manager
21
Source : http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/
Research Approach
255 ciphertext variants
Attributes Data
128-bit AES encryption
Ciphertext
GEM5 simulator
AES decryption static binary
Statistical Analysis
User
Actual System 23
GEM5 SIMULATOR ¢ Computer system simulation platform ¢ Supports various ISAs : Alpha, ARM, MIPS, Power, SPARC,
and x86 ¢ Two modes :
� System Emulation : ¢ Used for running individual applications or set of applications ¢ Used if you want do research on a particular application
� Full System Emulation : ¢ Used For booting OS ¢ Used if you want to do research on how does the OS effects our
application or devices ¢ Stats for Instruction Set Architecture related attributes
such as : � Instructions committed � Integer register reads & writes � ALU accesses � Arithmetic operations completed & many more… 24
00000000000000000000000000000000 dc95342e176fe8f26e62a997052847fd
00000000000000000000000000000001 dc95342e176fe8f26e62a997052847fd
00000000000000000000000000000002 dc95342e176fe8f26e62a997052847fd
000000000000000000000000000000ff dc95342e176fe8f26e62a997052847fd
Attack Approach – On AES-128 bit
27
Plaintext : zmx4wker02g6HELLOHOWSUqA (24 bytes) zmx4wker02g6HELLOHOWSUqAx08x08x08x08x08x08x08x08x08(32 bytes)
Ciphertext : 52cb50912065ac52a55a15d599a16930dc95342e176fe8f26e62a997052847fd (32 bytes)
GEM5 simulator
128-bit AES decryption static
binary
OPENSSL RESULTS ¢ For Last Byte
29
205471
205472
205473
205474
205475
205476
205477
00.lo
g 06
.log
0c.lo
g 12
.log
18.lo
g 1e
.log
24.lo
g 2a
.log
30.lo
g 36
.log
3c.lo
g 42
.log
48.lo
g 4e
.log
54.lo
g 5a
.log
60.lo
g 66
.log
6c.lo
g 72
.log
78.lo
g 7e
.log
84.lo
g 8a
.log
90.lo
g 96
.log
9c.lo
g a2
.log
a8.lo
g ae
.log
b4.lo
g ba
.log
c0.lo
g c6
.log
cc.lo
g d2
.log
d8.lo
g de
.log
e4.lo
g ea
.log
f0.lo
g f6
.log
fc.lo
g
No.
of
Inte
ger
Mul
tipl
icat
ions
Last Byte
Integer Multiplications At last byte = 0x39
OPENSSL RESULTS
¢ For Second Last Byte
30
98594000 98595000 98596000 98597000 98598000 98599000 98600000 98601000 98602000
00.lo
g 06
.log
0c.lo
g 12
.log
18.lo
g 1e
.log
24.lo
g 2a
.log
30.lo
g 36
.log
3c.lo
g 42
.log
48.lo
g 4e
.log
54.lo
g 5a
.log
60.lo
g 66
.log
6c.lo
g 72
.log
78.lo
g 7e
.log
84.lo
g 8a
.log
90.lo
g 96
.log
9c.lo
g a2
.log
a8.lo
g ae
.log
b4.lo
g ba
.log
c0.lo
g c6
.log
cc.lo
g d2
.log
d8.lo
g de
.log
e4.lo
g ea
.log
f0.lo
g f6
.log
fc.lo
g
No.
of
Inte
ger
Reg
iste
r R
eads
Second Last Byte
Integer Register Reads At second last byte = 0x63
WOLFSSL
� Lightweight embedded SSL library (20 times smaller than OpenSSL)
� Small footprint size(30-100kB) & low runtime memory usage(3-36kB)
� Targeted for embedded devices, RTOS & environments facing constraints in computational resources
� Major uses in MySQL, wireless sensors used in power grids etc.
33
00000000000000000000000000000000 5145ea93c3b647860c13228d8dc1e90c
Attack Approach – On AES–128 bit
35
Plaintext : POST/gp/redirect/indi.htmlCookie:token=wdH (42 bytes) POST/gp/redirect/indi.htmlCookie:token=wdHx06x06x06x06x06x06(48 bytes)
Ciphertext : c5421b878c2d36a052f45796ad1bdea11d501312a305f586369cd8e19136db095145ea93c3b647860c13228d8dc1e90c (48 bytes)
GEM5 simulator
128-bit AES decryption static
binary
00000000000000000000000000000001 5145ea93c3b647860c13228d8dc1e90c
00000000000000000000000000000002 5145ea93c3b647860c13228d8dc1e90c
000000000000000000000000000000ff 5145ea93c3b647860c13228d8dc1e90c
WOLFSSL RESULTS ¢ For Last Byte
36
448100000
448120000
448140000
448160000
448180000
448200000
00.lo
g 07
.log
0e.lo
g 15
.log
1c.lo
g 23
.log
2a.lo
g 31
.log
38.lo
g 3f
.log
46.lo
g 4d
.log
54.lo
g 5b
.log
62.lo
g 69
.log
70.lo
g 77
.log
7e.lo
g 85
.log
8c.lo
g 93
.log
9a.lo
g a1
.log
a8.lo
g af
.log
b6.lo
g bd
.log
c4.lo
g cb
.log
d2.lo
g d9
.log
e0.lo
g e7
.log
ee.lo
g f5
.log
fc.lo
g
No.
of
Inte
ger
Reg
iste
r R
ead
s
Last Byte
Integer Register Reads At a value where plaintext
byte becomes 0x00
POODLE ATTACK ¢ An encrypted post request looks as follows : ¢ An attacker can control both the request path & the request
body ¢ Hence, he can generate requests such that following two
conditions hold : a) The padding fills an entire block (encrypted into Cn). b) The cookies’ first as of yet unknown byte appears as the final byte
in an earlier block (encrypted into Ci).
POST /path Cookie: name=value...\r\n\r\nbody || 20byte MAC || padding
39
POODLE ATTACK ¢ Example original plaintext :
POST/gp/redirect/indi.htmlCookie:token=wdHZJaxBe……….
Attacker can modify this plaintext size as multiple of block size (say 8) & hence the padding will fill one complete last block which encrypts into Cn
48 Bytes
First Condition fulfilled
40
POODLE ATTACK ¢ To fulfill the second condition the plaintext is changed in this
manner :
Encrypts into Ci-1 Encrypts into Ci
Iteration 1
Iteration 2
Iteration 3
Iteration 4
41
Unknown byte appears as Final byte of a 8 byte block
POODLE ATTACK ¢ Cipher text corresponding to First Iteration :
¢ Replace Cn with Ci
Ciphertext : 5f06fc6cc5ff7b230fdcf40b1d0603ca0067df2ec6a8f3be0067df2ec6a8f3be5c48fe596cca889fb4e07a3571aac7ad26b8d80ac480904bb075cbf233b4d6298bf5816a3d3dca5fa7d5261e44b0ce4a545f137188deb3a49446a30343a09e38a73b3e45bd96efbb
Cn Ci
Ciphertext : 5f06fc6cc5ff7b230fdcf40b1d0603ca0067df2ec6a8f3be0067df2ec6a8f3be5c48fe596cca889fb4e07a3571aac7ad26b8d80ac480904bb075cbf233b4d6298bf5816a3d3dca5fa7d5261e44b0ce4a545f137188deb3a49446a30343a09e385c48fe596cca889f
Cn / Ci
Ci-1
Ci-1 42
POODLE ATTACK
43
0000000000000000 5c48fe596cca889f GEM5 simulator
3-DES decryption static binary
0000000000000001 5c48fe596cca889f
0000000000000002 5c48fe596cca889f
00000000000000ff 5c48fe596cca889f
WOLFSSL RESULTS ¢ For Last Byte
45
122525000
122530000
122535000
122540000
122545000
122550000
122555000
00.lo
g 07
.log
0e.lo
g 15
.log
1c.lo
g 23
.log
2a.lo
g 31
.log
38.lo
g 3f
.log
46.lo
g 4d
.log
54.lo
g 5b
.log
62.lo
g 69
.log
70.lo
g 77
.log
7e.lo
g 85
.log
8c.lo
g 93
.log
9a.lo
g a1
.log
a8.lo
g af
.log
b6.lo
g bd
.log
c4.lo
g cb
.log
d2.lo
g d9
.log
e0.lo
g e7
.log
ee.lo
g f5
.log
fc.lo
g No
. o
f M
emo
ry
Ref
eren
ces
Last Byte
Memory References Maximum value at byte = 0xc9
POODLE ATTACK
So, Cn’ xor Cn-1 = 0x00 Cn’ xor 0xc9 = 0x00
implies, Cn’ = (0xc9) xor (0x00) Cn’ = 0xc9 (intermediate byte of Cn/Ci)
5c 48 fe 59 6c ca 88 9f
Decrypt
?? ?? ?? ?? ?? ?? ?? 00
IV
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
39
00 00 00 00 00 00 00
00 00 00 00 00 00 00 39
Decrypt
means, Cn’ XOR Cn-1 = 0x01
?? XOR 39 = 00
Ci-1 = 0067df2ec6a8f3be Ci/Cn = 5c48fe596cca889f
46
From CBC Decryption Pi = (Intermediate byte of Ci) xor (Ci-1) Pi = (0xc9) xor (0xbe) Pi = 0x77 [Hex value for ‘w’]
Hence, cookie’s first unknown byte is revealed
Cn-1 Cn / Ci
WOLFSSL RESULTS
¢ For Second Last Byte
47
246070000
246080000
246090000
246100000
246110000
246120000
246130000
246140000
00.lo
g 07
.log
0e.lo
g 15
.log
1c.lo
g 23
.log
2a.lo
g 31
.log
38.lo
g 3f
.log
46.lo
g 4d
.log
54.lo
g 5b
.log
62.lo
g 69
.log
70.lo
g 77
.log
7e.lo
g 85
.log
8c.lo
g 93
.log
9a.lo
g a1
.log
a8.lo
g af
.log
b6.lo
g bd
.log
c4.lo
g cb
.log
d2.lo
g d9
.log
e0.lo
g e7
.log
ee.lo
g f5
.log
fc.lo
g
No.
of
com
mit
ted
in
stru
ctio
ns
Second Last Byte
Committed CPU Instructions Maximum value at byte = 0xf1
TAKEAWAYS
¢ Many Side-channels have effected cryptographic libraries
� These side channels have revived very often
� Instruction based side channels haven’t been explored
¢ OpenSSL and wolfSSL previously patched against padding oracle and POODLE attack
¢ We explored novel side-channels on popular SSL/TLS Implementations – eg. Memory accesses, CPU instructions etc.
¢ Successfully decipher all plaintext bytes 49
FUTURE WORK ¢ We performed it in simulation environment which has
its own bottleneck. Other tool which can give faster results can be used.
¢ We have used one API for OpenSSL & wolfSSL. Other APIs can be explored.
¢ Other cryptographic Libraries can be explored.
¢ Real Life Applications can be studied
50
REFERENCES � Ivanov, A. (2005). Side-Channel Attacks. � Skorobogatov, Sergei. "Side-channel attacks." � Lomne, Victor, et al. "Side Channel Attacks." Security Trends for FPGAS.
Springer Netherlands, 2011. 47-72. � Peeters, Eric, et al. "Improved higher-order side-channel attacks with
FPGA experiments." Cryptographic Hardware and Embedded Systems–CHES 2005. Springer Berlin Heidelberg, 2005. 309-323.
� Black, John, and Hector Urtubia. "Side-Channel Attacks on Symmetric Encryption Schemes: The Case for Authenticated Encryption." USENIX Security Symposium. 2002.
� Vaudenay, Serge. "Security Flaws Induced by CBC Padding—Applications to SSL, IPSEC, WTLS..." Advances in Cryptology—EUROCRYPT 2002. Springer Berlin Heidelberg, 2002.
� Paterson, Kenneth G., and Arnold Yau. "Padding oracle attacks on the ISO CBC mode encryption standard." Topics in Cryptology–CT-RSA 2004. Springer Berlin Heidelberg, 2004. 305-323.
� Yau, Arnold KL, Kenneth G. Paterson, and Chris J. Mitchell. "Padding oracle attacks on CBC-mode encryption with secret and random IVs." Fast Software Encryption. Springer Berlin Heidelberg, 2005.
� Rizzo, Juliano, and Thai Duong. "Practical Padding Oracle Attacks." WOOT. 2010.
� Duong, Thai, and Juliano Rizzo. "Padding oracles everywhere." (2010). 51
REFERENCES � Kaliski, Burt. "PKCS# 7: Cryptographic Message Syntax Version 1.5." (1998). � Möller, Bodo, Thai Duong, and Krzysztof Kotowicz. "This POODLE Bites:
Exploiting The SSL 3.0 Fallback." (2014). � Binkert, Nathan, et al. "The gem5 simulator." ACM SIGARCH Computer
Architecture News 39.2 (2011): 1-7. � Gluck, Yoel, Neal Harris, and Angelo Prado. "BREACH: reviving the CRIME
attack." � Irazoqui, Gorka, et al. "Lucky 13 Strikes Back." Proceedings of the 10th
ACM Symposium on Information, Computer and Communications Security. ACM, 2015.
� Blatz, Jeremiah. "CSRF: Attack and Defense." McAfee® Foundstone® Professional Services, White Paper (2007).
� Johny, Alphonsa. "Secure Socket Layer Implementations-A." � Kumar, Uday, Tuhin Borgohain, and Sugata Sanyal. "Comparative Analysis of
Cryptography Library in IoT." arXiv preprint arXiv:1504.04306 (2015). � Krawczyk. " The Order of Encryption and Authentication for Protecting
Communications." CRYPTO 2001 � Juliano Rizzo, Thai Duong."Here Come The Ninjas."Ekoparty 2011 � Juliano Rizzo, Thai Duong."The CRIME Attack."Ekoparty 2012
52