Information Security Group Royal Holloway, University of London 6th Feb 2012
Contents 1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6
Results 1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6
Plaintext-recovery attacks through which we were able to: Decrypt arbitrary amount of ciphertext in the case of the OpenSSL implementation of DTLS. Decrypt the four most significant bits of the last byte in every block in the case of the GnuTLS implementation of DTLS.
Background DTLS versus TLS 1 Results 2 Background DTLS versus TLS 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6 3
Background DTLS versus TLS Datagram Transport Layer Security (DTLS) was first introduced in NDSS 2004. IETF assigned RFC 4347 to DTLS 1.0 in 2006. RFC 6347 updates RFC 4347 and was published in Jan 2012 under DTLS 1.2. By design, DTLS 1.0 is very similar to TLS 1.1. RFC 4347 presents only the changes to TLS 1.1 and refers to RFC 4346 for the rest of the specification. A number of RFC documents have been published on DTLS. DTLS is used in a number of implementations.
Background DTLS versus TLS DTLS runs over an unreliable protocol such as Unreliable Datagram Protocol (UDP). Handshake Protocol Change Cipher Spec Alert Protocol Record Protocol Applications TLS! Reliable Transport Protocol Handshake Protocol Change Cipher Spec Alert Protocol Applications Record Protocol DTLS! Unreliable Transport Protocol
Background DTLS versus TLS Changes to TLS 1.1 also include: Implementations of DTLS should silently discard data with bad MACs or padding. No error messages are generated in both cases. In DTLS, connections are not terminated in the case of an error. In DTLS, fragmentation of record messages is not permitted. DTLS optionally supports record replay protection. There are other changes, but they are not of relevance.
Vaudenay s Padding Oracle Canvel et al. Work 1 Results 2 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 3 Vaudenay s Padding Oracle Canvel et al. Work 6
Vaudenay s Padding Oracle Canvel et al. Work Vaudenay s padding oracle, (PO) applies to CBC-mode encryption. PO returns VALID if the padding is correct and INVALID otherwise. The realisation of this oracle relies on the attacker having access to TLS error messages; decryption failed and bad record mac which are classified as fatal. In the case of TLS 1.0, both of these error messages are encrypted. Connections are terminated immediately whenever such errors are encountered. Algorithm 1: Decrypting a block using a padding oracle PO for TL- S/DTLS. Data: Ct 1, C t Result: Pt = D k (Ct ) C t 1 Let R be a random b-byte block.; for i =0to b 1 do for byte =0to 255 do R[i] =byte; C = R Ct ; if PO(C) = VALID then P[i] =R[i] Ct 1 [i] i; Break; Output P; for j =0to i do R[j] =R[j] (i) (i +1);
Vaudenay s Padding Oracle Canvel et al. Work The work of Canvel et al. exploits the fact that processing a message with valid padding may take longer than the processing of a message with invalid padding: The timing difference comes from the MAC verification process. Canvel et al. were able to extract fixed plaintext in the form of TLS-encrypted passwords. Connections had to be re-established after being terminated, making the attack difficult to implement. Countermeasures were introduced in TLS 1.1: One of them is to perform MAC verification on packets that fail the padding check.
OpenSSL Implementation of DTLS Timing and Packet Processing Results 1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL OpenSSL Implementation of DTLS Timing and Packet Processing Results 5 Attacking the GnuTLS Implementation of DTLS 6
OpenSSL Implementation of DTLS Timing and Packet Processing Results DTLS Packets with invalid padding are silently discarded and MAC verification is not performed. No error messages are generated when the padding error is encountered. This protects the system from the attack introduced by Canvel et al. We constructed a new realisation for the padding oracle to exploit the OpenSSL implementation of DTLS. Algorithm 2: Padding Oracle for OpenSSL implementation of DTLS Data: C Result: VALID or INVALID for q =1to m do RTT q = Timer(C); RTT =Mean(RTT 1, RTT 2,...,RTT m); if RTT T then return VALID; else return INVALID; Timer(C) Set T s =currenttime; Send n copies of P C,aDTLSpacketcontainingC, to the targeted system; Send a Heartbeat request packet to the targeted system; Set T e = time when Heartbeat response packet is seen; return (T e T s )
OpenSSL Implementation of DTLS Timing and Packet Processing Results We were able to use Heartbeat messages to compensate the lack of error messages. The advisory sends a Heartbeat request message right after the attack message(s). The advisory calculates the time from sending the first message to receiving the Heartbeat response message. To amplify the timing difference we used a train of packets.
OpenSSL Implementation of DTLS Timing and Packet Processing Results packet 1 t 1,0 t 1,1 t 1,2 t 1,3 packet 2 Time-line for packet train with valid padding t 2,0 t 2,1 t 2,2 t 2,3 Heartbeat Request Heartbeat Response T s T f T e packet 1 Time-line for packet train with invalid padding t 1,0 t 1,1 t 1,3 packet 2 t 2,0 t 2,1 t 2,3 Heartbeat Request Heartbeat Response T s T f T e
OpenSSL Implementation of DTLS Timing and Packet Processing Results 0.30 0.25 0.20 0.08 0.06 0.06 0.05 0.04 0.15 0.04 0.03 0.10 0.05 0.02 0.02 0.01 540 560 580 600 620 640 (a) l =256 1240 1260 1280 1300 1320 1340 (b) l =1024 1660 1680 1700 1720 (c) l =1456 Figure: 3DES PDFs for trains of 10 packets and varying the DTLS payload length, l. 0.20 0.15 0.10 0.15 0.10 0.12 0.10 0.08 0.06 0.05 0.05 0.04 0.02 520 530 540 550 560 570 580 (a) l =256 1210 1215 1220 1225 1230 (b) l =1024 1580 1590 1600 1610 1620 1630 (c) l =1456 Figure: AES-256 PDFs for trains of 10 packets and varying the DTLS payload length, l.
OpenSSL Implementation of DTLS Timing and Packet Processing Results n and l 128 160 192 224 256 288 1 0.99 0.99 1.00 0.99 1.00 0.99 2 0.99 1.00 0.99 1.00 1.00 0.98 5 0.99 1.00 1.00 1.00 1.00 0.98 10 0.98 1.00 0.99 1.00 1.00 0.99 20 0.99 0.99 1.00 1.00 1.00 0.99 50 0.99 0.99 1.00 1.00 0.98 0.95 Table: Success probabilities per byte for AES, for various attack parameters (with anti-replay disabled). n is the train size and l is the DTLS payload size in bytes.
1 Results 2 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 3 6
Unlike OpenSSL, GnuTLS share the same code for TLS and DTLS. GnuTLS implements the fix introduced in TLS 1.1 and hence is not vulnerable to our attack against OpenSSL. We were able to recover the four most significant bits of the last byte in each ciphertext block by exploiting a different issue in the code and using the same technique. 0.014 0.012 0.010 0.008 0.006 0.004 0.002 100 200 300 400 Figure: PDFs for AES-256 with HMAC-SHA256, l =176,n =5,based on 1000 trials, with outliers removed.
Fixes On 4th of Jan 2012, OpenSSL issued releases 1.0.0f and 0.9.8s which included a fix. On 6th of Jan 2012, GnuTLS issued release 3.0.11 which included a fix.
1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6
Lack of error messages does not necessarily mean that the system is not vulnerable. Although the GnuTLS implementation of DTLS follows the standard, we were able to deploy similar techniques to attack the implementation and recover a limited amount plaintext. Features of lower layer protocols can have a major influence on security at higher layers.