CryptokiX: a cryptographic software token with security fixes

Transcription

1 Tookan tool for cryptoki analysis CryptokiX: a cryptographic software token with security fixes Riccardo Focardi Università Ca' Foscari, Venezia joint work with M. Bortolozzo, M. Centenaro and G. Steel 4th International Workshop on Analysis of Security APIs (ASA-4) July 21, 2010, Edinburgh Work partially supported by MIUR project SOFT Security Oriented Formal Techniques

2 PKCS#11 PIN should protect sensitive objects even on a compromised hosts (PIN can be easily intercepted )

3 PKCS#11 Objects Objects are referenced via handles sensitive: true encrypt: true decrypt: true Every object has attributes Encrypt some data under the orange key

4 PKCS#11 Key Management Create a new key inside the token Export a key encrypted under another key (WrapKey) { } sensitive: true encrypt: true decrypt: true { } Import a previously exported key (UnwrapKey)

5 A well known attack This class of attacks can be prevented by imposing policies on the attributes (no need of new crypto mechanisms!) sensitive: true wrap: true decrypt: true Wrap the green key with the red one { } { } sensitive: true Decrypt it with the orange key

6 Attribute Policies Sticky Tokens might implement the standard in different ways Which policies do they implement? How do they protect from key-separation attacks? Once an attribute is set (unset), it may not be unset (set). Read-only attributes can be thought as both sticky on and off. Conflicting Pairs of attributes that cannot be simultaneously set. (Not in the PKCS#11 documentation) Tied Attributes whose value is tied (changing one also changes the other)

7 Modeling Real Tokens Templates ::= generatetemplates(templatelist); create_templates(templatelist); unwrap_templates(templatelist); PKCS11_CONFIG::= TemplateList ::= nil (Template),TemplateList Template ::= nil (Attribute, BOOL), Template sticky_on(attributelist) sticky_off(attributelist) conflict(attributepairlist) tied(attributepairlist) sensitive_prevents_read(bool); unextractable_prev_read(bool); Attribute_Restrictions Templates Flags 3 4 SATMC Tookan Device 2 1

8 Analysing opencryptoki sticky_on_asymmetric('sensitive'); sticky_off_asymmetric('extract'); sticky_on_symmetric('sensitive', 'never_extract'); sticky_off_symmetric('extract', 'never_extract'); conflict_symmetric(); conflict_asymmetric(); There There are are no no conflicting conflicting attributes attributes No No clever clever sticky sticky policies policies tied_symmetric('sensitive,always_sensitive', 'extract,never_extract'); tied_asymmetric('sensitive,always_sensitive', 'extract,never_extract'); sensitive_prevents_read(true); unextractable_prevents_read(true);

9 Attacking opencryptoki (1/3) Wrap and Decrypt (conflict) h_mykey = GenerateKey({decrypt => true, wrap => true}); wrapped = WrapKey(h_myKey, h_sensitivekey); thesensitivekey = Decrypt(h_myKey, wrapped); print ("oops: " + thesensitivekey); $ wrap_and_decrypt_conflict Generating mykey {decrypt =>; true, wrap => true} Wrapping sensitivekey with mykey Decrypting the wrapped key using mykey oops: 50891f2f7a487bc3

10 Attacking opencryptoki (2/3) Wrap and Decrypt (sticky) h_mykey = GenerateKey(h_myKey, {decrypt => false, wrap => true}); wrapped = WrapKey(h_myKey, h_sensitivekey); SetAttributes(h_mykey, {wrap => false, decrypt => true}); sensitivekey = Decrypt(h_myKey, wrapped); print ("oops: " + sensitivekey); $ wrap_and_decrypt_sticky Generating mykey {decrypt => false, wrap => true} Wrapping sensitivekey with mykey Changing mykey to {wrap => false, decrypt => true} Decrypting the wrapped key using mykey oops: 50891f2f7a487bc3

11 Attacking opencryptoki (3/3) Wrap and Decrypt (key aliases ) wrapped=403aldb4f345fdc0 $ wrapping_format // whatever bytestream h_mykey = GenerateKey(h_myKey, {unwrap => true}); h_deckey=unwrapkey(h_mykey, wrapped, {decrypt => true, wrap => false}); h_wrapkey=unwrapkey(h_mykey, wrapped, {decrypt => false, wrap => true}); wrapped=wrapkey(h_wrapkey, h_sensitivekey); sensitivekey=decrypt(h_deckey, wrapped); print ("oops: " + sensitivekey); Generating unwrapkey {unwrap => true} Unwrap wrapped as deckey {decrypt => true, wrap => false} Unwrap wrapped as wrapkey {decrypt => false, wrap => true} Wrapping sensitivekey under wrapkey Decrypting the wrapped key using deckey oops: 50891f2f7a487bc3

12 CryptokiX CryptokiX is a fixed software token based on opencryptoki Its security is configurable by selectively enabling different patches Available at

13 CryptokiX Conflicts Users can specify conflicting attributes sticky_on_asymmetric('sensitive'); sticky_off_asymmetric('extract'); sticky_on_symmetric('sensitive', 'never_extract'); sticky_off_symmetric('extract', 'never_extract'); conflict_symmetric('wrap,decrypt', 'unwrap,encrypt'); conflict_asymmetric(); tied_symmetric('sensitive,always_sensitive', 'extract,never_extract'); tied_asymmetric('sensitive,always_sensitive', 'extract,never_extract'); sensitive_prevents_read(true); unextractable_prevents_read(true);

14 CryptokiX Conflicts Users can specify conflicting attributes sticky_on_asymmetric('sensitive'); $ wrap_and_decrypt_conflict sticky_off_asymmetric('extract'); sticky_on_symmetric('sensitive', Generating mykey {decrypt => true, 'never_extract'); wrap => true} sticky_off_symmetric('extract', ERROR swtok common/key.c:1308 Conflicting 'never_extract'); attributes detected ERROR swtok common/new_host.c:3922 Key Generation failed conflict_symmetric('wrap,decrypt', wrap_and_decrypt_conflict.c:70 C_GenerateKey 'unwrap,encrypt'); () exited with error conflict_asymmetric(); $ wrap_and_decrypt_sticky tied_symmetric('sensitive,always_sensitive', 'extract,never_extract'); tied_asymmetric('sensitive,always_sensitive', Generating mykey {decrypt => false, wrap => true} 'extract,never_extract'); Wrapping sensitivekey with mykey sensitive_prevents_read(true); Changing mykey to {wrap => false, decrypt => true} unextractable_prevents_read(true); Decrypting the wrapped key using mykey oops: 50891f2f7a487bc3

15 CryptokiX Sticky Users can specify sticky attributes sticky_on_asymmetric('sensitive'); sticky_off_asymmetric('extract'); sticky_on_symmetric('sensitive', 'never_extract', 'wrap', 'unwrap', 'encrypt', 'decrypt'); sticky_off_symmetric('extract', 'never_extract'); conflict_symmetric(); conflict_asymmetric(); tied_symmetric('sensitive,always_sensitive', 'extract,never_extract'); tied_asymmetric('sensitive,always_sensitive', 'extract,never_extract'); sensitive_prevents_read(true); unextractable_prevents_read(true);

16 CryptokiX Sticky $ wrap_and_decrypt_sticky Users can specify sticky attributes Generating mykey {decrypt => false, wrap => true} Wrapping sensitivekey with mykey sticky_on_asymmetric('sensitive'); Changing mykey to {wrap => false, decrypt => true} sticky_off_asymmetric('extract'); ERROR swtok common/key.c:1398 Attempt to modify a sticky attribute sticky_on_symmetric('sensitive', 'never_extract', 'wrap', 'unwrap', detected 'encrypt', 'decrypt'); ERROR swtok ommon/new_host.c:2083 Object Set Attribute Values Failed sticky_off_symmetric('extract', 'never_extract'); wrap_and_decrypt_sticky.c:80 C_SetAttributes () exited with error conflict_symmetric(); $ wrapping_format conflict_asymmetric(); Generating unwrapkey {unwrap => true} tied_symmetric('sensitive,always_sensitive', Unwrap wrapped as deckey {decrypt => true, wrap 'extract,never_extract'); => false} tied_asymmetric('sensitive,always_sensitive', Unwrap wrapped wrapkey {decrypt => false, wrap 'extract,never_extract'); => true} Wrapping sensitivekey under wrapkey sensitive_prevents_read(true); Decrypting the wrapped key using deckey unextractable_prevents_read(true); oops: 50891f2f7a487bc3

17 CryptokiX Wrapping format keep track of key template when wrapping it check that it corresponds when unwrapping Encode sensitive, always_sensitive, wrap, unwrap, encrypt and decrypt attributes in one byte Compute a CBC-MAC of the standard WrapKey result and the encoded attributes $ wrapping_format Generating unwrapkey {unwrap => true} Unwrap wrapped as deckey {decrypt => true,wrap => false} ERROR swtok common/key_mgr.c:1440 Template Inconsistent ERROR swtok common/new_host.c:4170 Unwrap Key Failed wrapping_format.c:72 C_UnwrapKey () exited with error

18 CryptokiX Secure templates NEW limit the set of admissible assignments for key attributes configurable for each PKCS#11 command generate, unwrap, create first secure configuration of PKCS#11 that does not require new cryptographic mechanisms

19 CryptokiX Secure templates Key generation Key encrypting keys (wrap and unwrap set) Data key (encrypt and decrypt set) Imported keys unwrap,encrypt set and wrap,decrypt unset

20 CryptokiX Secure templates Unwrap: true Encrypt: true Encrypted communication Unwrap: true Encrypt: true { } { } Encrypt: true Decrypt: true Encrypt: true Decrypt: true

21 CryptokiX Secure templates Encrypted communication {this is a secret} {I'll tell no one}

22 CryptokiX A secure, fully fledge token can be realized in practice Useful for educational purposes Open-source Patches can be examined Fixes can be extended by anyone Future work Make it configurable at run-time Implement more fixes

23 References [1] CryptokiX. [2] opencryptoki. [3] M. Bortolozzo, M. Centenaro, R. Focardi, and G. Steel. Attacking and Fixing PKCS#11 Security Tokens. To appear at ACM CCS, October 2010 [4] J. Clulow. On the security of PKCS#11. In CHES 2003 [5] S. Delaune, S. Kremer, and G. Steel. Formal analysis of PKCS#11. In IEEE CSF 08 [6] RSA Security Inc., v2.20. PKCS #11: Cryptographic Token Interface Standard., June 2004.

24 Thank you! (contact me if you want to see a demo offline)