Dragonblood: A Security Analysis of WPA3s SAE Handshake Mathy - - PowerPoint PPT Presentation

▶
dragonblood a security analysis
SMART_READER_LITE
LIVE PREVIEW

Dragonblood: A Security Analysis of WPA3s SAE Handshake Mathy - - PowerPoint PPT Presentation

Jul 31, 2023 341 likes •1.04k views

Dragonblood: A Security Analysis of WPA3s SAE Handshake Mathy Vanhoef and Eyal Ronen WAC Workshop @ CRYPTO, Santa Barbara, 17 August 2019. Background: Dragonfly in WPA3 and EAP-pwd = Password Authenticated Key Exchange (PAKE) Negotiate

slide-1
SLIDE 1

Dragonblood: A Security Analysis

  • f WPA3’s SAE Handshake

Mathy Vanhoef and Eyal Ronen WAC Workshop @ CRYPTO, Santa Barbara, 17 August 2019.

slide-2
SLIDE 2

Background: Dragonfly in WPA3 and EAP-pwd

2

Negotiate session key Provide mutual authentication

Forward secrecy & prevent offline dictionary attacks Protect against server compromise

= Password Authenticated Key Exchange (PAKE)

slide-3
SLIDE 3

Dragonfly

3

slide-4
SLIDE 4

Dragonfly

4

Convert password to group element P Convert password to group element P

slide-5
SLIDE 5

Dragonfly

5

Convert password to group element P Convert password to group element P

Commit phase

slide-6
SLIDE 6

Dragonfly

6

Convert password to group element P Convert password to group element P

Commit phase

Negotiate shared key

slide-7
SLIDE 7

Dragonfly

7

Convert password to group element P Convert password to group element P

Commit phase Confirm phase

Negotiate shared key

slide-8
SLIDE 8

Dragonfly

8

Convert password to group element P Convert password to group element P

Commit phase Confirm phase

Negotiate shared key Confirm peer negotiated same key

slide-9
SLIDE 9

Dragonfly

9

Convert password to group element P Convert password to group element P

Commit phase Confirm phase

Supports two crypto groups:

  • 1. MODP groups
  • 2. Elliptic curves
slide-10
SLIDE 10

Dragonfly

10

Convert password to group element P Convert password to group element P

Commit phase Confirm phase

Supports two crypto groups:

  • 1. MODP groups
  • 2. Elliptic curves
slide-11
SLIDE 11

What are MODP groups?

 All operations are MODulo the Prime (= MODP)

11

Operations performed on integers x where: › x < 𝑞 with 𝑞 a prime › 𝑦𝑟 mod 𝑞 = 1 must hold › 𝑟 = #elements in the group

slide-12
SLIDE 12

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

12

slide-13
SLIDE 13

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

13

Convert value to a MODP element

slide-14
SLIDE 14

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

14

Problem for groups 22-24: high chance that value >= p

slide-15
SLIDE 15

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: ??? P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

15

slide-16
SLIDE 16

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

16

slide-17
SLIDE 17

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

17

#iterations depends on password

slide-18
SLIDE 18

Convert password to MODP element

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟 return P

18

No timing leak countermeasures, despite warnings by IETF & CFRG! #iterations depends on password

slide-19
SLIDE 19

IETF mailing list in 2010

19

“[..] susceptible to side channel (timing) attacks and may leak the shared password. I'd therefore recommend [excluding the MAC addresses].” “not so sure how important that is [..] doesn't leak the shared password [..] not a trivial attack.”

slide-20
SLIDE 20

Leaked information: #iterations needed

20

Client address addrA Measured

slide-21
SLIDE 21

Leaked information: #iterations needed

21

Client address addrA Measured Password 1 Password 2 Password 3

slide-22
SLIDE 22

Leaked information: #iterations needed

22

Client address addrA Measured Password 1 Password 2 Password 3

slide-23
SLIDE 23

What information is leaked?

for (counter = 1; counter < 256; counter++) value = hash(pw, counter, addr1, addr2) if value >= p: continue P = 𝑤𝑏𝑚𝑣𝑓(𝑞−1)/𝑟

23

Spoof client address to obtain different execution & leak new data

slide-24
SLIDE 24

Leaked information: #iterations needed

24

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-25
SLIDE 25

Leaked information: #iterations needed

25

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-26
SLIDE 26

Leaked information: #iterations needed

26

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

slide-27
SLIDE 27

Leaked information: #iterations needed

27

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

Need ~17 addresses to determine password in RockYou (~𝟐𝟏𝟖) dump

slide-28
SLIDE 28

Leaked information: #iterations needed

28

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

Forms a signature of the password Need ~17 addresses to determine password in RockYou (~𝟐𝟏𝟖) dump

slide-29
SLIDE 29

Raspberry Pi 1 B+: differences are measurable

29

Hostap AP: ~75 measurements / address

slide-30
SLIDE 30

What about elliptic curves?

 Need to convert password to point (x,y) on the curve

30

Operations performed on points (x, y) where: › x < 𝑞 and y < 𝑞 with 𝑞 a prime › 𝑧2 = 𝑦3 + 𝑏𝑦 + 𝑐 mod 𝑞 must hold

slide-31
SLIDE 31

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

31

EAP-pwd: similar timing leak with elliptic curves

slide-32
SLIDE 32

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

32

WPA3: always do 40 loops & return first P

slide-33
SLIDE 33

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

33

Extra iterations based

  • n random password
slide-34
SLIDE 34

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

34

Problem for Bainpool curves: high chance that x >= p

slide-35
SLIDE 35

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

35

slide-36
SLIDE 36

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

36

Code may be skipped

slide-37
SLIDE 37

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

37

#Times skipped depends on password

slide-38
SLIDE 38

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

38

#Times skipped depends on password & random password in extra itreations

slide-39
SLIDE 39

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

39

Variance ~ when password element was found

slide-40
SLIDE 40

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

40

Variance ~ when password element was found Average ~ when found & #iterations code skipped

slide-41
SLIDE 41

Raspberry Pi 1 B+

41

Hostap (WPA3): ~300 measurements / address

slide-42
SLIDE 42

42

Cache Attacks

slide-43
SLIDE 43

NIST Elliptic Curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

43

NIST curves: use Flush+Reload to detect when code is executed

slide-44
SLIDE 44

NIST Elliptic Curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

44

NIST curves: use Flush+Reload to detect when code is executed Monitor using Flush+Reload to know in which iteration we are

slide-45
SLIDE 45

Bainpool Elliptic Curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

45

Monitor using Flush+Reload to know in which iteration we are Brainpool curves: use Flush+Reload to detect when code is executed

slide-46
SLIDE 46

Cache-attacks in practice

Requires powerfull adversary: › Run unpriviliged code on victim’s machine › Act as malicious client/AP within range of victim

46

Abuse leaked info to recover the password › Spoof various client addresses similar to timing attack › Use resulting password signature in dictionary attack

slide-47
SLIDE 47

Attack Optimizations

Timing & cache attack result in password signature › Both use the same brute-force algorithm Improve performance using GPU code: › We can brute-force 𝟐𝟏𝟐𝟏 passwords for $1 › MODP / Brainpool: all 8 symbols costs $67 › NIST curves: all 8 symbols costs $14k

47

slide-48
SLIDE 48

Detailed Analysis: See Paper

› Estimate required #(spoofed MAC addresses):

48

› Offline brute-force cost:

slide-49
SLIDE 49

Implementation Inspection

49

slide-50
SLIDE 50

Invalid Curve Attack

50

Commit(x’, y’)

Point isn’t on curve

slide-51
SLIDE 51

Invalid Curve Attack

51

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable

slide-52
SLIDE 52

Invalid Curve Attack

52

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable Guess key and send confirm Confirm phase

slide-53
SLIDE 53

Invalid Curve Attack

53

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable Guess key and send confirm Confirm phase

Bypasses authentication

  • EAP-pwd: all implementations affected
  • WPA3: only iwd is vulnerable
slide-54
SLIDE 54

Reflection Attack: EAP-pwd example

54

Commit(x, y) Commit(x, y) Reflect frame association

slide-55
SLIDE 55

Reflection Attack: EAP-pwd example

55

Commit(x, y) Commit(x, y) Reflect frame Confirm Confirm Reflect frame association

slide-56
SLIDE 56

Reflection Attack: EAP-pwd example

56

Commit(x, y) Commit(x, y) Reflect frame Confirm Confirm Reflect frame association

Authenticate as victim

  • EAP-pwd: all servers are vulnerable
  • WPA3: old wpa_supplicants affected
slide-57
SLIDE 57

Other Implementation Vulnerabilities

57

Bad randomness: › Can recover password element P › Aruba’s EAP-pwd client for Windows is affected › With WPA2 bad randomness has lower impact! Side-channels: › FreeRADIUS aborts if >10 iterations are needed › Aruba’s EAP-pwd aborts if >30 are needed › Can use leaked info to recover password

slide-58
SLIDE 58

Wi-Fi Specific Attacks

58

slide-59
SLIDE 59

Denial-of-Service Attack

59

Convert password to group element P Convert password to group element P

AP converts password to EC point when client connects

› Conversion is computationally expensive (40 iterations) › Forging 8 connections/sec saturates AP’s CPU

slide-60
SLIDE 60

Downgrade Against WPA3-Transition

Transition mode: WPA2/3 use the same password › WPA2’s handshake detects downgrades  forward secrecy › Performing partial WPA2 handshake  dictionary attacks Solution is to remember which networks support WPA3 › Similar to trust on first use of SSH & HSTS › Implemented by Pixel 3 and Linux’s NetworkManager

60

slide-61
SLIDE 61

Crypto Group Downgrade

Handshake can be performed with multiple curves › Initiator proposes curve & responder accepts/rejects › Spoof reject messages to downgrade used curve

61

= design flaw, all client & AP implementations vulnerable

slide-62
SLIDE 62

Implementation-specific downgrades

› Clone WPA3-only network & advertise it only supports WPA2 › Galaxy S10 & iwd connected using the WPA3-only password › Results in trivial dictionary attack

62

iwd

slide-63
SLIDE 63

63

Disclosure

slide-64
SLIDE 64

Disclosure process

Notified parties early with hope to influence WPA3 › Some initially sceptic, considered it implementation flaws › Group downgrade: “was known, but forgot to warn about it” Reaction of the Wi-Fi Alliance › Privately created backwards-compatible security guidelines › 2nd disclosure round to address Brainpool side-channels

64

slide-65
SLIDE 65

Fundamental issue still unsolved

› On lightweight devices, doing 40 iterations is too costly › Even powerfull devices are at risk: handshake might be

  • ffloaded the lightweight Wi-Fi chip itself

65

!

Wi-Fi standard now being updated › Prevent crypto group downgrade attack › Allow offline computation of password element

slide-66
SLIDE 66

Additional upates to Wi-Fi standard

66

Elliptic curve groups: › Restrict usage of weak elliptic curves › Constant-time algo (simplified SWU)

MODP crypto groups: › Restrict usage of weak MODP groups › Constant-time algo (modulo intead of iterations)

slide-67
SLIDE 67

Updates aren’t backwards-compatible

Might lead to WPA3.1? › Not yet clear how this will be handled › Risk of downgrade attacks to original WPA3

67

Will people be able to easily attack WPA3? › No, WPA3 > WPA2 even with its flaws › Timing leaks: non-trival to determine if vulnerable

slide-68
SLIDE 68

Conclusion

› WPA3 vulnerable to side-channels › Countermeasures are costly › Standard now being updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

68

slide-69
SLIDE 69

Thank you! Questions?

› WPA3 vulnerable to side-channels › Countermeasures are costly › Standard now being updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

69