The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS - - PowerPoint PPT Presentation

▶
the 9 lives of bleichenbacher s cat
SMART_READER_LITE
LIVE PREVIEW

The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS - - PowerPoint PPT Presentation

Mar 21, 2024 158 likes •1.36k views

The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations Eyal Ronen , Robert Gillham, Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom Transport Layer Security (TLS) The most widely used cryptographic protocol

slide-1
SLIDE 1

The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations

Eyal Ronen, Robert Gillham, Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom

slide-2
SLIDE 2

Transport Layer Security (TLS)

  • The most widely used cryptographic protocol
  • Provides communication security (https, VPN, etc.)
  • TLS handshake is used for authentication and

secure key exchange

  • TLS Record layer protects the communication
  • Allows for cryptographic agility using different

cipher suites

slide-3
SLIDE 3

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
slide-4
SLIDE 4

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
slide-5
SLIDE 5

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
  • Long history of practical implementation attacks*
slide-6
SLIDE 6

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
  • Long history of practical implementation attacks*
  • No forward secrecy
slide-7
SLIDE 7

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
  • Long history of practical implementation attacks*
  • No forward secrecy
  • Still widely used (Dec 2018)
  • ~6% by Mozilla's Telemetry and

ICSI Certificate Notary

slide-8
SLIDE 8

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
  • Long history of practical implementation attacks*
  • No forward secrecy
  • Still widely used (Dec 2018)
  • ~6% by Mozilla's Telemetry and

ICSI Certificate Notary

  • Better alternatives now available (e.g. Ephemeral ECDH)
slide-9
SLIDE 9

RSA Key Exchange in TLS

  • Uses the PKCS #1 v1.5 padding scheme
  • Once the most popular TLS key exchange option
  • Long history of practical implementation attacks*
  • No forward secrecy
  • Still widely used (Dec 2018)
  • ~6% by Mozilla's Telemetry and

ICSI Certificate Notary

  • Better alternatives now available (e.g. Ephemeral ECDH)
  • Supported for backwards compatibility
slide-10
SLIDE 10

9 lives of Bleichenbacher’s CAT

  • We tested the latest version of 9 different TLS implementations
slide-11
SLIDE 11

9 lives of Bleichenbacher’s CAT

  • We tested the latest version of 9 different TLS implementations
  • 7 found vulnerable to new cache based RSA padding attacks
slide-12
SLIDE 12

9 lives of Bleichenbacher’s CAT

  • We tested the latest version of 9 different TLS implementations
  • 7 found vulnerable to new cache based RSA padding attacks
  • Multiple vulnerabilities in different layers of the protocol
slide-13
SLIDE 13

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
slide-14
SLIDE 14

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
  • We show the feasibility of MiTM downgrade attack
slide-15
SLIDE 15

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
  • We show the feasibility of MiTM downgrade attack
  • Cause modern client and server to use RSA KX
slide-16
SLIDE 16

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
  • We show the feasibility of MiTM downgrade attack
  • Cause modern client and server to use RSA KX
  • Novel parallelization technique for RSA padding oracle attacks
slide-17
SLIDE 17

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
  • We show the feasibility of MiTM downgrade attack
  • Cause modern client and server to use RSA KX
  • Novel parallelization technique for RSA padding oracle attacks
  • Break 100% of the connections to servers that use vulnerable

implementations

slide-18
SLIDE 18

9 lives of Bleichenbacher’s CAT

  • We broke 6% of the Internet, so what?
  • Only old clients use RSA KX
  • We show the feasibility of MiTM downgrade attack
  • Cause modern client and server to use RSA KX
  • Novel parallelization technique for RSA padding oracle attacks
  • Break 100% of the connections to servers that use vulnerable

implementations

  • Works also if client doesn’t support RSA KX
slide-19
SLIDE 19

RSA Encryption

slide-20
SLIDE 20

RSA Encryption

  • Nice math, but how can we use it on real data?
slide-21
SLIDE 21

RSA Encryption

  • Nice math, but how can we use it on real data?
  • There are several real world problems
slide-22
SLIDE 22

Why do we need padding

  • Assume e = 3, m = 1000, N ~ 22048
slide-23
SLIDE 23

Why do we need padding

  • Assume e = 3, m = 1000, N ~ 22048
  • me < N, logarithm over the reals is easy
  • m should be larger
slide-24
SLIDE 24

Why do we need padding

  • Assume e = 3, m = 1000, N ~ 22048
  • me < N, logarithm over the reals is easy
  • m should be larger
  • Assume encryption of Yes/No – value 0 or 1
slide-25
SLIDE 25

Why do we need padding

  • Assume e = 3, m = 1000, N ~ 22048
  • me < N, logarithm over the reals is easy
  • m should be larger
  • Assume encryption of Yes/No – value 0 or 1
  • Vulnerable to dictionary attack
  • Easy to detect repetitions
  • m should be random
slide-26
SLIDE 26

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
slide-27
SLIDE 27

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
  • Example for RSA key exchange in TLS 1.2

[48 bytes of premaster secret] 0x00 [non-zero padding] 0x0002

slide-28
SLIDE 28

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
  • Example for RSA key exchange in TLS 1.2

[48 bytes of premaster secret] 0x00 [non-zero padding] 0x0002

Encryption preamble

slide-29
SLIDE 29

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
  • Example for RSA key exchange in TLS 1.2

[48 bytes of premaster secret] 0x00 [non-zero padding] 0x0002

Encryption preamble At least 8 random non zero bytes

slide-30
SLIDE 30

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
  • Example for RSA key exchange in TLS 1.2

[48 bytes of premaster secret] 0x00 [non-zero padding] 0x0002

Encryption preamble At least 8 random non zero bytes Zero delimiter

slide-31
SLIDE 31

PKCS #1 v1.5 padding scheme

  • Used to pad and encrypt the plaintext
  • Pads the plaintext to the RSA public key length
  • Adds randomization
  • Example for RSA key exchange in TLS 1.2

[48 bytes of premaster secret] 0x00 [non-zero padding] 0x0002

Encryption preamble At least 8 random non zero bytes Zero delimiter Has specific TLS structure

slide-32
SLIDE 32

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation
slide-33
SLIDE 33

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

Ciphertext C

slide-34
SLIDE 34

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

Ciphertext C

slide-35
SLIDE 35

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

Ciphertext C

Starts with 00 02 ?

slide-36
SLIDE 36

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

Ciphertext C

Starts with 00 02 ?

Requires Side Channel

slide-37
SLIDE 37

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

Ciphertext C

Starts with 00 02 ?

slide-38
SLIDE 38

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

C1 Ciphertext C

Starts with 00 02 ?

slide-39
SLIDE 39

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

C1 valid/invalid Ciphertext C

Starts with 00 02 ?

slide-40
SLIDE 40

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

C1 valid/invalid C2 valid/invalid Ciphertext C

Starts with 00 02 ?

slide-41
SLIDE 41

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

C1 valid/invalid C2 valid/invalid Ciphertext C …

Starts with 00 02 ?

slide-42
SLIDE 42

Bleichenbacher’s Attack

  • 1998: Adaptive chosen-ciphertext attack
  • Exploits strict RSA PKCS#1 v1.5 padding validation

C1 valid/invalid M = Dec(C) C2 valid/invalid Ciphertext C …

Starts with 00 02 ?

slide-43
SLIDE 43
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection

ME WANT COOKIE!

slide-44
SLIDE 44
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection
  • Attack scenario for RSA KX:

ME WANT COOKIE!

slide-45
SLIDE 45
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection
  • Attack scenario for RSA KX:
  • Sniff TLS handshake and first message

ME WANT COOKIE!

slide-46
SLIDE 46
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection
  • Attack scenario for RSA KX:
  • Sniff TLS handshake and first message
  • Use Bleich. to decrypt premaster secret

ME WANT COOKIE!

slide-47
SLIDE 47
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection
  • Attack scenario for RSA KX:
  • Sniff TLS handshake and first message
  • Use Bleich. to decrypt premaster secret
  • Decrypt first message

ME WANT COOKIE!

slide-48
SLIDE 48
  • Session cookies give access to the users’ data
  • Are sent in the beginning of each TLS connection
  • Attack scenario for RSA KX:
  • Sniff TLS handshake and first message
  • Use Bleich. to decrypt premaster secret
  • Decrypt first message
  • COOKIE!

ME WANT COOKIE!

slide-49
SLIDE 49

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-50
SLIDE 50

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-51
SLIDE 51

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-52
SLIDE 52

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-53
SLIDE 53

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-54
SLIDE 54

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-55
SLIDE 55

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-56
SLIDE 56

Attack Scenario RSA KX: Sniff + Cache timing side channel

slide-57
SLIDE 57
  • Only 6% of connections use RSA KX

ME WANT COOKIE! ALL COOKIES!

slide-58
SLIDE 58
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack

ME WANT COOKIE! ALL COOKIES!

slide-59
SLIDE 59
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX

ME WANT COOKIE! ALL COOKIES!

slide-60
SLIDE 60
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX
  • Works also on TLS 1.3 [JSS 15]

ME WANT COOKIE! ALL COOKIES!

slide-61
SLIDE 61
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX
  • Works also on TLS 1.3 [JSS 15]
  • Require active MiTM attack

ME WANT COOKIE! ALL COOKIES!

slide-62
SLIDE 62
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX
  • Works also on TLS 1.3 [JSS 15]
  • Require active MiTM attack
  • COOKIE?

ME WANT COOKIE! ALL COOKIES!

slide-63
SLIDE 63
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX
  • Works also on TLS 1.3 [JSS 15]
  • Require active MiTM attack
  • COOKIE?
  • Time to finish attack < 30 sec

ME WANT COOKIE! ALL COOKIES!

slide-64
SLIDE 64
  • Only 6% of connections use RSA KX
  • Use RSA KX vulnerability for downgrade attack
  • Only requires server support for RSA KX
  • Works also on TLS 1.3 [JSS 15]
  • Require active MiTM attack
  • COOKIE?
  • Time to finish attack < 30 sec
  • Need many queries
  • Have time for < 600
  • ME WANT COOKIE! ALL COOKIES!
slide-65
SLIDE 65
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

Downgrade attack on Firefox

slide-66
SLIDE 66
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

  • Do MiTM downgrade attack

Downgrade attack on Firefox

slide-67
SLIDE 67
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

  • Do MiTM downgrade attack
  • Keep session alive during padding attack

Downgrade attack on Firefox

slide-68
SLIDE 68
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

  • Do MiTM downgrade attack
  • Keep session alive during padding attack
  • Finish the TLS handshake with decrypted

premaster secret

Downgrade attack on Firefox

slide-69
SLIDE 69
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

  • Do MiTM downgrade attack
  • Keep session alive during padding attack
  • Finish the TLS handshake with decrypted

premaster secret

  • Cookie?

Downgrade attack on Firefox

slide-70
SLIDE 70
  • We can prevent timeout in Firefox’s TLS handshakes using

TLS warning alerts [ABDG+15]

  • Do MiTM downgrade attack
  • Keep session alive during padding attack
  • Finish the TLS handshake with decrypted

premaster secret

  • Cookie?
  • The user will notice the delay

Downgrade attack on Firefox

slide-71
SLIDE 71

The Boost of the BEAST

  • BEAST like attack can help!
slide-72
SLIDE 72

The Boost of the BEAST

  • BEAST like attack can help!
  • JavaScript in browser allows the attacker to repeatedly reopen

connections in the background, without the user’s knowledge.

slide-73
SLIDE 73

The Boost of the BEAST

  • BEAST like attack can help!
  • JavaScript in browser allows the attacker to repeatedly reopen

connections in the background, without the user’s knowledge.

  • At the start of each connection, the same session cookie is

sent in the first packet

slide-74
SLIDE 74

The Boost of the BEAST

  • BEAST like attack can help!
  • JavaScript in browser allows the attacker to repeatedly reopen

connections in the background, without the user’s knowledge.

  • At the start of each connection, the same session cookie is

sent in the first packet

  • Need to break just one connection
slide-75
SLIDE 75

The Boost of the BEAST

  • BEAST like attack can help!
  • JavaScript in browser allows the attacker to repeatedly reopen

connections in the background, without the user’s knowledge.

  • At the start of each connection, the same session cookie is

sent in the first packet

  • Need to break just one connection
  • COOKIE!
slide-76
SLIDE 76

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-77
SLIDE 77

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-78
SLIDE 78

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-79
SLIDE 79

Attack Scenario Firefox: MiTM + Cache timing side channel

.COM

slide-80
SLIDE 80

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-81
SLIDE 81

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-82
SLIDE 82

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-83
SLIDE 83

Attack Scenario Firefox: MiTM + Cache timing side channel

slide-84
SLIDE 84
  • Most browsers timeout TLS handshake after 30 seconds

Parallel Downgrade attack

slide-85
SLIDE 85
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers

Parallel Downgrade attack

slide-86
SLIDE 86
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers
  • We can parallelize the attack across multiple servers

Parallel Downgrade attack

slide-87
SLIDE 87
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers
  • We can parallelize the attack across multiple servers
  • Each server is a separate oracle

Parallel Downgrade attack

slide-88
SLIDE 88
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers
  • We can parallelize the attack across multiple servers
  • Each server is a separate oracle
  • Many previous works mention parallelization

Parallel Downgrade attack

slide-89
SLIDE 89
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers
  • We can parallelize the attack across multiple servers
  • Each server is a separate oracle
  • Many previous works mention parallelization
  • Cookie?

Parallel Downgrade attack

slide-90
SLIDE 90
  • Most browsers timeout TLS handshake after 30 seconds
  • Many companies reuse certificate on multiple servers
  • We can parallelize the attack across multiple servers
  • Each server is a separate oracle
  • Many previous works mention parallelization
  • Cookie?
  • Need at least 2048 sequential

adaptive queries

  • Have time for < 600

Parallel Downgrade attack

slide-91
SLIDE 91

A little Manger background

  • Assume we have the following Manger oracle
slide-92
SLIDE 92

A little Manger background

  • Assume we have the following Manger oracle
  • We start with a blinding phase to find s such that
slide-93
SLIDE 93

A little Manger background

  • Assume we have the following Manger oracle
  • We start with a blinding phase to find s such that

N-1

slide-94
SLIDE 94

A little Manger background

  • Assume we have the following Manger oracle
  • We start with a blinding phase to find s such that

N-1

slide-95
SLIDE 95

A little Manger background

  • Iteratively reduce size of possible interval

N-1

slide-96
SLIDE 96

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-97
SLIDE 97

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-98
SLIDE 98

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-99
SLIDE 99

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-100
SLIDE 100

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-101
SLIDE 101

A little Manger background

  • Iteratively reduce size of possible interval
  • After additional i sequential queries we learn that

N-1

slide-102
SLIDE 102
  • Run k attacks in parallel with i sequential queries each

The Cookie Lattice

slide-103
SLIDE 103
  • Run k attacks in parallel with i sequential queries each
  • Similar to Boneh & Venkatesan’s Hidden Number Problem

The Cookie Lattice

slide-104
SLIDE 104
  • Run k attacks in parallel with i sequential queries each
  • Similar to Boneh & Venkatesan’s Hidden Number Problem
  • Finding m is reduced to CVP that we can embed in a SVP lattice

and solve with LLL

The Cookie Lattice

slide-105
SLIDE 105
  • Run k attacks in parallel with i sequential queries each
  • Similar to Boneh & Venkatesan’s Hidden Number Problem
  • Finding m is reduced to CVP that we can embed in a SVP lattice

and solve with LLL

  • We need just 5 servers to

decrypt 2048 bit RSA using a Manger oracle

The Cookie Lattice

slide-106
SLIDE 106
  • Run k attacks in parallel with i sequential queries each
  • Similar to Boneh & Venkatesan’s Hidden Number Problem
  • Finding m is reduced to CVP that we can embed in a SVP lattice

and solve with LLL

  • We need just 5 servers to

decrypt 2048 bit RSA using a Manger oracle

The Cookie Lattice

slide-107
SLIDE 107

The Cookie Lattice Tradeoff

  • The initial blinding phase is more “expensive” per bit
slide-108
SLIDE 108

The Cookie Lattice Tradeoff

  • The initial blinding phase is more “expensive” per bit
  • The parallel attack requires more queries!
slide-109
SLIDE 109

The Cookie Lattice Tradeoff

  • The initial blinding phase is more “expensive” per bit
  • The parallel attack requires more queries!
  • So why do we do it?
slide-110
SLIDE 110

The Cookie Lattice Tradeoff

  • The initial blinding phase is more “expensive” per bit
  • The parallel attack requires more queries!
  • So why do we do it?
  • Tradeoff between the total number of queries and number of

sequential queries

slide-111
SLIDE 111

The Cookie Lattice Tradeoff

  • The initial blinding phase is more “expensive” per bit
  • The parallel attack requires more queries!
  • So why do we do it?
  • Tradeoff between the total number of queries and number of

sequential queries

  • Allows us to finish attack in less than 30 seconds
slide-112
SLIDE 112

Attack Scenario Parallel: MiTM + Cache timing side channel

slide-113
SLIDE 113

Attack Scenario Parallel: MiTM + Cache timing side channel

slide-114
SLIDE 114

Attack Scenario Parallel: MiTM + Cache timing side channel

slide-115
SLIDE 115

Our results

  • New Techniques for Microarchitectural Padding Oracle

Attacks, vulnerabilities in 7 out 9 implementations

  • PoC for Manger and Bleichenbacher attacks
slide-116
SLIDE 116

Our results

  • New Techniques for Microarchitectural Padding Oracle

Attacks, vulnerabilities in 7 out 9 implementations

  • PoC for Manger and Bleichenbacher attacks
  • Parallelization for downgrade attack
  • PoC for Manger parallelization using LLL
slide-117
SLIDE 117

Disclosure

  • We disclosed to:
  • OpenSSL, Mozilla’s NSS, Amazon’s s2n, Apple’s CoreTLS,

mbed TLS, wolfSSL, GnuTLS

  • All have patched their code, with various levels of success
  • Lots of stories…
slide-118
SLIDE 118

Recommendation

  • Many recommendations for several layers of

mitigations in the paper

  • Bottom line Don’t use RSA KX
  • It has failed us too many times
slide-119
SLIDE 119

Recommendation

  • Many recommendations for several layers of

mitigations in the paper

  • Bottom line Don’t use RSA KX
  • It has failed us too many times
  • If you really really really must
  • Separate your certificates!
  • …
slide-120
SLIDE 120

Questions?

  • Paper website

https://cat.eyalro.net

  • Any questions?