THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE Dennis - - PowerPoint PPT Presentation

▶
the dangers of key reuse practical attacks on ipsec ike
SMART_READER_LITE
LIVE PREVIEW

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE Dennis - - PowerPoint PPT Presentation

Nov 21, 2022 210 likes •477 views

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE Dennis Felsch 1 , Martin Grothe 1 , Jrg Schwenk 1 , Adam Czubak 2 , Marcin Szymanek 2 1 : Ruhr University Bochum, Germany 2 : University of Opole, Poland 27 TH USENIX SECURITY SYMPOSIUM

slide-1
SLIDE 1

Dennis Felsch 1, Martin Grothe 1, Jörg Schwenk 1, Adam Czubak 2, Marcin Szymanek 2

1: Ruhr University Bochum, Germany 2: University of Opole, Poland

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE

27TH USENIX SECURITY SYMPOSIUM 08/16/2018

slide-2
SLIDE 2

VPNs (Virtual Private Networks)

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 2

4G/LTE

Internet

Icons from KDE Oxygen theme licensed under GNU LGPLv3, http://www.kde.org/

slide-3
SLIDE 3

IPsec (Internet Protocol Security)

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 3 THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018

Internet Transport Network Access

TCP/UDP IP TCP/UDP IP IPsec IPsec

Application

integrity authenticity confidentitiality

Data Data

slide-4
SLIDE 4

IKE (Internet Key Exchange)

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 4

  • The handshake protocol of IPsec
  • Standardized in two major versions
  • IKEv1: Published in 1998, declared obsolete by the IETF
  • nevertheless included in all implementations
  • IKEv2: Published in 2005, current version
slide-5
SLIDE 5

IKEv1

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 5 THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 5

Internet Transport Network Access

UDP IP UDP IP

Application

IKEv1 IKEv1

Negotiation Authentication Key Agreement Key Confirmation 2 msg 2 msg 2 msg

slide-6
SLIDE 6

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 6

m1 m2 m1= {proposals} m3= gx, anc. data m2 = selected proposal m4= gy , anc. data m3 m4

  • 1. Key derivation
  • 2. Compute MACR

m6 = Enc(MACR | data)

  • 3. Decrypt m5
  • 4. Verify MACI

m5 m6

  • 1. Key derivation
  • 2. Compute MACI

m5 = Enc(MACI | data)

  • 3. Decrypt m6
  • 4. Verify MACR

IKEv1 Protocol Flow

Initiator Responder

slide-7
SLIDE 7

IKEv1 Authentication Methods

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 7

1. PSK (Pre-Shared-Key) 2. Digital Signatures 3. Public Key Encryption (PKE) 4. Revised Public Key Encryption (RPKE)

Negotiation Authentication Key Agreement Key Confirmation 2 msg 2 msg 2 msg

slide-8
SLIDE 8

m1 m2 m3 m4 m5 m6

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 8

m1= {proposals} m3= gx, anc. data m2 = selected proposal m4= gy , anc. data

  • 1. Key derivation
  • 2. Compute MACR

m6 = Enc(MACR | data)

  • 3. Decrypt m5
  • 4. Verify MACI
  • 1. Key derivation
  • 2. Compute MACI

m5 = Enc(MACI | data)

  • 3. Decrypt m6
  • 4. Verify MACR

IKEv1 Protocol Flow With PKE Authentication

m3= gx, Encpk(nI) m4= gy, Encpk(nR)

Initiator Responder

slide-9
SLIDE 9

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 9

What if implementations contained Bleichenbacher oracles?

slide-10
SLIDE 10
  • Padding oracle attack
  • RSA PKCS#1 v1.5 encryption padding:
  • Attack requires oracle that tells if padding is valid

Bleichenbacher‘s Attack In Two Slides

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 10

slide-11
SLIDE 11

Bleichenbacher‘s Attack In Two Slides

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 11

m

Sender Receiver

m'

Attacker

valid / invalid m'' valid / invalid …

  • Leaks the plaintext of message m to the attacker
slide-12
SLIDE 12

m1 m2 m4= EncpkB(nRA), … m3 m6 m5

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 12

Attack Idea On IKEv1 With PKE Authentication

Attacker Responder B Responder A

Decrypt nRA Derive Keys Keep A waiting Attacker impersonates Responder B !

slide-13
SLIDE 13

Where To Find The PKE And RPKE Modes?

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 13

  • Cisco includes PKE authentication in IOS
  • Huawei includes RPKE in some security appliances
  • Implementations in Clavister’s cOS and ZyXEL’s

ZyWALL USG devices broken

slide-14
SLIDE 14

Where To Find The PKE And RPKE Modes?

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 14

slide-15
SLIDE 15

Case Study: Bleichenbacher Oracle In Cisco IOS 1/3

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 15

  • Test device:
  • Cisco ASR 1001-X router
  • IOS XE 03.16.02.S
slide-16
SLIDE 16

Case Study: Bleichenbacher Oracle In Cisco IOS 2/3

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 16

m1 m2 m3 m4 m1= proposal with PKE m2 = proposal with PKE

Initiator Cisco IOS

m3 m2 m3 with valid padding wait 1 second m3 with invalid padding m2 = proposal with PKE

slide-17
SLIDE 17

Case Study: Bleichenbacher Oracle In Cisco IOS 3/3

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 17

  • IOS cancels IKEv1 handshake after 60 seconds at the latest
  • Public key 1024 bits ⇒ ~850 responses per second
  • 60 ∙ 850 = 51,000 requests per handshake
  • Empirical study with a simulator:

26 % of attacks require less than 51,000 requests

slide-18
SLIDE 18

Cisco IOS – Simulator vs. Real Hardware

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 18

  • Cisco’s IKE handshake implementation is not optimized

for throughput

  • Cryptographic calculations for IKE are done by CPU
  • m1/m2 negotiations take a lot of time
  • Decryption attack with 19,000 requests took 13 minutes
slide-19
SLIDE 19

Cisco IOS – Is An Attack Realistic?

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 19

  • A too slow attack does not permanently lock out

attackers

  • Still dangerous if the victim has deployed multiple

responders sharing one key pair

  • e. g. for load balancing
slide-20
SLIDE 20

Bleichenbacher Oracles In (R)PKE Implementations

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 20

  • Cisco: CVE-2018-0131
  • Huawei: CVE-2017-17305
  • Clavister: CVE-2018-8753
  • ZyXEL: CVE-2018-9129
  • Patches are available!
slide-21
SLIDE 21

Key Reuse

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 21

  • Maintaining individual key pairs for all variants of IKE?
  • Common practice: A single RSA key pair
  • Actual security depends on
  • cross-ciphersuite,
  • cross-version, and
  • cross-protocol security
slide-22
SLIDE 22

Bleichenbacher’s Attack & Signatures

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 22

  • For RSA:
  • A decryption & creating a signature is the same
  • peration
  • Bleichenbacher’s attack can forge a signature
slide-23
SLIDE 23

Attack Against IKEv2 With Signatures

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 23

  • Signature Based Authentication
  • Supported by IKEv1 and IKEv2
  • IKEv2 on Cisco router: 4 minutes time
  • For Cisco: Simulation succeeds in 22% of attacks
  • Real hardware again lacks performance
slide-24
SLIDE 24

Additional Contributions In The Paper

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 24

  • A dictionary attack against PSK authentication in main

mode (CVE-2018-5389)

  • Message flow diagrams of all IKE variants
  • Description of the oracles in Huawei’s, Clavister’s, and

ZyXEL’s implementations

  • Description of our parallelized Bleichenbacher attacker
slide-25
SLIDE 25

THE DANGERS OF KEY REUSE: PRACTICAL ATTACKS ON IPSEC IKE | DENNIS FELSCH 27TH USENIX SECURITY SYMPOSIUM | 08/16/2018 25

Questions?

Dennis Felsch Ruhr University Bochum Horst Görtz Institute for IT-Security Chair for Network and Data Security dennis.felsch@rub.de @dfelsch https://web-in-security.blogspot.de