cat.eyalro.netThe 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations | Eyal Ronen

Eyal Ronen Home Publications Talks Projects Contact The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations Nov 30, 2018 PDF Slides Eyal Ronen , Robert Gillham, Daniel Genkin , Adi Shamir, David Wong and Yuval Yarom Download Full Paper ‘‘Those who’ll play with cats must expect to be scratched.’’ – Miguel de Cervantes, Don Quixote . Abstract At CRYPTO'98, Bleichenbacher published his seminal paper which described a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5 standard. Over the last twenty years researchers and implementors had spent a huge amount of effort in developing and deploying numerous mitigation techniques which were supposed to plug all the possible sources of Bleichenbacher-like leakages. However, as we show in this paper most implementations are still vulnerable to several novel types of attack based on leakage from various microarchitectural side channels: Out of nine popular implementations of TLS that we tested, we were able to break the security of seven implementations with practical proof-of-concept attacks. We demonstrate the feasibility of using those Cache-like ATacks (CATs) to perform a downgrade attack against any TLS connection to a vulnerable server, using a BEAST-like Man in the Browser attack. The main difficulty we face is how to perform the thousands of oracle queries required before the browser’s imposed timeout (which is 30 seconds for almost all browsers, with the exception of Firefox which can be tricked into extending this period). The attack seems to be inherently sequential (due to its use of adaptive chosen ciphertext queries), but we describe a new way to parallelize Bleichenbacher-like padding attacks by exploiting any available number of TLS servers that share the same public key certificate. With this improvement, we could demonstrate the feasibility of a downgrade attack which could recover all the 2048 bits of the RSA plaintext (including the premaster secret value, which suffices to establish a secure connection) from five available TLS servers in under 30 seconds. This sequential-to-parallel transformation of such attacks can be of independent interest, speeding up and facilitating other side channel attacks on RSA implementations. Acknowledgments The authors would like to thank Orr Dunkelman for his contribution, in particular for his insights about the parallelization of the attack using LLL. Logo by John Schwegel Eyal Ronen Publications Eyal Ronen , Robert Gillham , Daniel Genkin , Adi Shamir , David Wong , Yuval Yarom January 2019 Real World Crypto 2020 and IEEE Symposium on SecurityPrivacy The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations PDF Project Slides Video Talks Jan 8, 2020 1:00 PM New York, USA The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations PDF Project Slides Video Aug 17, 2019 1:00 PM Santa Barbara, USA The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations PDF Project Slides Video Dec 8, 2018 1:00 PM COSIC, KU Leuven The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations PDF Project Video Dec 8, 2018 1:00 PM Adelaide, Australia The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations PDF Project © 2019 Eyal Ronen · Powered by the Academic theme for Hugo . Cite × Copy...