CarderPlanet
Professional
- Messages
- 2,549
- Reaction score
- 730
- Points
- 113
Hubert Kario, a Czech security researcher working for Red Hat, presented at the European Symposium on Computer Security that ended yesterday the Marvin attack technique, which allows you to determine the source data by measuring delays in performing decryption operations based on the RSA algorithm. In practice, the proposed method allows you to decrypt traffic or generate digital signatures without knowing the private RSA key. To test the attack's applicability, a special script for checking TLS servers and tools for detecting problems in libraries have been published.
The attack is a variation of Bleichenbacher's method, proposed in 1998, and continues the development of the ROBOT (Return Of Bleichenbacher's Oracle Threat) and New CAT (New Cache ATtack) attacks, published in 2017 and 2019. The essence of the method is that an attacker can separate correct and incorrect padding oracle blocks added in accordance with the PKCS #1 v1.5 standard for aligning encrypted data along the block boundary based on different server responses and different operation execution times. By manipulating information about the correctness of additional padding blocks, an attacker can brute-force a suitable ciphertext.
However, the attack does not directly recover the private key, but only allows you to decrypt the ciphertext or generate a fake signed message. A successful attack requires sending a very large amount of test messages for decryption. The difference between the Marvin method boils down to improving the technique of separating correct and incorrect additional data, filtering false positives, more accurate determination of delays in calculations, and the use of additional third-party channels during measurement.
Using an attack against TLS servers that use RSA key-based encryption allows an attacker to passively store the intercepted traffic and later decrypt it. For servers that support PFS (Perfect forward secrecy), conducting an attack is much more complicated and success depends on how quickly the attack is carried out. In addition, the method allows you to create a dummy digital signature that certifies the contents of ServerKeyExchange messages in TLS 1.2 or CertificateVerify in TLS 1.3 transmitted during the key exchange stage, which can be used to perform MITM attacks to intercept the TLS connection between the client and server.
MITM attacks are significantly complicated due to the fact that digital signatures cover not only the transmitted data, but also a random value selected by the client, as well as the need to forge the signature in a relatively short time before the client closes the connection after the timeout expires (to optimize the selection, it is proposed to send a large number of verification documents in parallel requests).
The issue affects various protocol implementations that use RSA and PKCS #1 v1.5, such as TLS, XML Encryption, PKCS#11 interfaces, JWT (JSON Web Token), JOSE (Javascript Object Signing and Encryption), and S/MIME. Despite the fact that modern cryptographic libraries have some kind of protection against attacks based on the Bleichenbacher method, the study revealed that the libraries still have unclosed leak channels and do not provide a constant processing time for packets with correct and erroneous additional padding. For example, the implementation of the Marvin attack on GnuTLS is not tied to the code that directly performs calculations related to RSA, but uses different execution times for the code that decides whether to output an error message.
The possibility of a Marvin attack is revealed in the TLS implementations offered in the libraries:
• OpenSSL (CVE-2022-4304). The vulnerability is caused by an information leak in the RSA decryption code. The issue was fixed in the February OpenSSL updates (3.0.8 and 1.1.1 t).
• GnuTLS (CVE-2023-0361). The vulnerability is caused by a difference in response time when processing RSA ciphertext in a ClientKeyExchange message with correct and incorrect padding PKCS#1 v1.5. The problem was fixed in the February release of GnuTLS 3.8.0.
• Mozilla NSS (CVE-2023-4421). Problems related to the non-constant execution time of some RSA operations depending on the processed data are identified. The vulnerability was partially fixed in release 3.61. Additional fixes are expected in the NSS 3.94 release, which is scheduled for next week.
• pyca/cryptography (CVE-2020-25659). Changes that block the vulnerability were made in 2020, but they were not enough without the fixes added to OpenSSL in 2021.
• M2Crypto (CVE-2020-25657). Security was added a year ago, but it is only effective together with changes to the OpenSSL API.
• OpenSSL-ibmca. Fixes addressing issues with non-constant processing time for RSA PKCS#1 v1.5 incremental padding and OAEP were added in the March 2.4.0 release.
In addition, the GNU MP library (mpz_powm_sec function) and the Go module crypto/rsa (DecryptPKCS1v15SessionKey function) identified vulnerable API calls that lead to leaks that can be used to perform attacks that analyze the dependence of the speed of operations on the processed data (timing attacks). Among the tested projects that are not susceptible to attack, the BoringSSL library is marked.
Since the attack is based on a fundamental vulnerability in RSA-based decryption operations with padding that meets the PKCS#1 v1. 5 standard, and over 25 years of existence, problems in libraries have not provided a constant processing time for packets with correct and erroneous padding, it is proposed to stop using RSA on TLS as an optimal solution-servers in favor of ECDH-based ciphers (Elliptic Curve Diffie Hellman).
The author of the study also believes that the considered class of vulnerabilities is not limited to RSA and can affect many other cryptographic algorithms that depend on standard libraries for integer calculations, for example, using BIGNUM from OpenSSL, MPI from NSS, Java BigInteger, Python int, Rust apint, GnuMP mpz_t, Go math/big Int, etc. As an example of the potential applicability of the method, the Minerva attack on the implementation of the ECDSA/EdDSA digital signature creation algorithm is given.
To confirm the possibility of a Marvin attack in practice, the researcher demonstrated the applicability of the method to applications based on the M2Crypto and pyca/cryptography libraries, in which several hours were enough to compromise encryption when conducting an experiment on an average laptop. For example, in experiments with the M2Crypto library on a Lenovo T480 laptop with an Intel i7-8650U CPU, an attack to decrypt ciphertext using 1024-bit RSA keys took 9 hours and required sending 163 thousand verification requests.
The organization of practical attacks on TLS servers over the network requires more complex manipulations, which strongly depend on the size of keys, the CPU model on the victim's system, hardware configuration features, the operating system, the RSA implementation used, and the distance between the server and the attackers (to account for network delays). In the best case scenario, conducting a targeted network attack on the victim's system connected via the same network switch with the attacker will require several days when using OpenSSL on the victim's side and several hours when using NSS.
The attack is a variation of Bleichenbacher's method, proposed in 1998, and continues the development of the ROBOT (Return Of Bleichenbacher's Oracle Threat) and New CAT (New Cache ATtack) attacks, published in 2017 and 2019. The essence of the method is that an attacker can separate correct and incorrect padding oracle blocks added in accordance with the PKCS #1 v1.5 standard for aligning encrypted data along the block boundary based on different server responses and different operation execution times. By manipulating information about the correctness of additional padding blocks, an attacker can brute-force a suitable ciphertext.
However, the attack does not directly recover the private key, but only allows you to decrypt the ciphertext or generate a fake signed message. A successful attack requires sending a very large amount of test messages for decryption. The difference between the Marvin method boils down to improving the technique of separating correct and incorrect additional data, filtering false positives, more accurate determination of delays in calculations, and the use of additional third-party channels during measurement.
Using an attack against TLS servers that use RSA key-based encryption allows an attacker to passively store the intercepted traffic and later decrypt it. For servers that support PFS (Perfect forward secrecy), conducting an attack is much more complicated and success depends on how quickly the attack is carried out. In addition, the method allows you to create a dummy digital signature that certifies the contents of ServerKeyExchange messages in TLS 1.2 or CertificateVerify in TLS 1.3 transmitted during the key exchange stage, which can be used to perform MITM attacks to intercept the TLS connection between the client and server.
MITM attacks are significantly complicated due to the fact that digital signatures cover not only the transmitted data, but also a random value selected by the client, as well as the need to forge the signature in a relatively short time before the client closes the connection after the timeout expires (to optimize the selection, it is proposed to send a large number of verification documents in parallel requests).
The issue affects various protocol implementations that use RSA and PKCS #1 v1.5, such as TLS, XML Encryption, PKCS#11 interfaces, JWT (JSON Web Token), JOSE (Javascript Object Signing and Encryption), and S/MIME. Despite the fact that modern cryptographic libraries have some kind of protection against attacks based on the Bleichenbacher method, the study revealed that the libraries still have unclosed leak channels and do not provide a constant processing time for packets with correct and erroneous additional padding. For example, the implementation of the Marvin attack on GnuTLS is not tied to the code that directly performs calculations related to RSA, but uses different execution times for the code that decides whether to output an error message.
The possibility of a Marvin attack is revealed in the TLS implementations offered in the libraries:
• OpenSSL (CVE-2022-4304). The vulnerability is caused by an information leak in the RSA decryption code. The issue was fixed in the February OpenSSL updates (3.0.8 and 1.1.1 t).
• GnuTLS (CVE-2023-0361). The vulnerability is caused by a difference in response time when processing RSA ciphertext in a ClientKeyExchange message with correct and incorrect padding PKCS#1 v1.5. The problem was fixed in the February release of GnuTLS 3.8.0.
• Mozilla NSS (CVE-2023-4421). Problems related to the non-constant execution time of some RSA operations depending on the processed data are identified. The vulnerability was partially fixed in release 3.61. Additional fixes are expected in the NSS 3.94 release, which is scheduled for next week.
• pyca/cryptography (CVE-2020-25659). Changes that block the vulnerability were made in 2020, but they were not enough without the fixes added to OpenSSL in 2021.
• M2Crypto (CVE-2020-25657). Security was added a year ago, but it is only effective together with changes to the OpenSSL API.
• OpenSSL-ibmca. Fixes addressing issues with non-constant processing time for RSA PKCS#1 v1.5 incremental padding and OAEP were added in the March 2.4.0 release.
In addition, the GNU MP library (mpz_powm_sec function) and the Go module crypto/rsa (DecryptPKCS1v15SessionKey function) identified vulnerable API calls that lead to leaks that can be used to perform attacks that analyze the dependence of the speed of operations on the processed data (timing attacks). Among the tested projects that are not susceptible to attack, the BoringSSL library is marked.
Since the attack is based on a fundamental vulnerability in RSA-based decryption operations with padding that meets the PKCS#1 v1. 5 standard, and over 25 years of existence, problems in libraries have not provided a constant processing time for packets with correct and erroneous padding, it is proposed to stop using RSA on TLS as an optimal solution-servers in favor of ECDH-based ciphers (Elliptic Curve Diffie Hellman).
The author of the study also believes that the considered class of vulnerabilities is not limited to RSA and can affect many other cryptographic algorithms that depend on standard libraries for integer calculations, for example, using BIGNUM from OpenSSL, MPI from NSS, Java BigInteger, Python int, Rust apint, GnuMP mpz_t, Go math/big Int, etc. As an example of the potential applicability of the method, the Minerva attack on the implementation of the ECDSA/EdDSA digital signature creation algorithm is given.
To confirm the possibility of a Marvin attack in practice, the researcher demonstrated the applicability of the method to applications based on the M2Crypto and pyca/cryptography libraries, in which several hours were enough to compromise encryption when conducting an experiment on an average laptop. For example, in experiments with the M2Crypto library on a Lenovo T480 laptop with an Intel i7-8650U CPU, an attack to decrypt ciphertext using 1024-bit RSA keys took 9 hours and required sending 163 thousand verification requests.
The organization of practical attacks on TLS servers over the network requires more complex manipulations, which strongly depend on the size of keys, the CPU model on the victim's system, hardware configuration features, the operating system, the RSA implementation used, and the distance between the server and the attackers (to account for network delays). In the best case scenario, conducting a targeted network attack on the victim's system connected via the same network switch with the attacker will require several days when using OpenSSL on the victim's side and several hours when using NSS.
