ROCA vulnerability

The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability. "ROCA" is an acronym for "Return of Coppersmith's attack".[1] The vulnerability has been given the identifier CVE-2017-15361.

ROCA vulnerability
CVE identifier(s)CVE-2017-15361
Date discoveredFebruary 2017 (February 2017)
DiscovererMatúš Nemec, Marek Sýs, et. al (Masaryk University)
Affected hardwareTPM, Yubikey, Gemalto IDPrime .NET smart cards
Affected softwareAny public-private key encryption that used RSALib including BitLocker and PGP

The vulnerability arises from a problem with an approach to RSA key generation used in a software library, RSALib, provided by Infineon Technologies, and incorporated into many smart cards, Trusted Platform Module (TPM), and Hardware Security Modules (HSM) implementations, including YubiKey 4 tokens, often used to generate PGP keys. Keys of lengths 512, 1024, and 2048 bits generated using the Infineon library are vulnerable to a practical ROCA attack.[2][3] The research team that discovered the attack (all with Masaryk University and led by Matúš Nemec and Marek Sýs)[2] estimate that it affects around one-quarter of all current TPM devices globally.[4] Millions of smart cards are believed to be affected.[1]

The team informed Infineon of the RSALib problem in February 2017, but withheld public notice until mid-October, citing responsible disclosure. At that time they announced the attack and provided a tool to test public keys for vulnerability. They published the details of the attack in November.[2]

Technical details

Generating an RSA key involves selecting two large randomly-generated prime numbers, a process that can be time-consuming, particularly on small devices, such as smart cards. In addition to being primes, the numbers should have certain other properties for best security. The vulnerable RSALib selection process quickly creates primes of the desired type by only testing for primality numbers of the form:

where is the product of the first n successive primes (2, 3, 5, 7, 11, 13,...), and n is a constant that only depends on the desired key size. The security is based on the secret constants and . The ROCA attack exploits this particular format for primes using a variation of the Coppersmith method. In addition, public keys generated this way have a distinctive fingerprint that can be quickly recognized by attempting to compute the discrete logarithm of the public key mod to base 65537. Computing discrete logarithms in a large group is usually extremely difficult, but in this case it can be done efficiently using the Pohlig–Hellman algorithm because is a smooth number. A test site is available on the Internet.[2][5][6][7] In short, keys that fit this format have significantly low entropy and can be attacked relatively efficiently (weeks to months), and the format can be confirmed ("fingerprinted") by the attacker very quickly (microseconds).

Mitigation

The ROCA authors consider public keys of length 512, 1024 and 2048-bits generated by RSALib to be vulnerable. Because the details of key generation differ for different key lengths, shorter keys are not necessarily more vulnerable than longer keys. For example a 1952-bit RSAlib key is stronger than a 2048-bit key and a 4096-bit key is weaker than a 3072-bit key.

The best mitigation, according to the authors, is to generate RSA keys using a stronger method, such as by OpenSSL. If that is not possible, the ROCA authors suggest using key lengths that are less susceptible to ROCA such as 3936-bit, 3072-bit or, if there is a 2048-bit key size maximum, 1952-bits.[2]:Sec 5.1

See also

References
  1. Goodin, Dan (2017-10-23). "Crippling crypto weakness opens millions of smartcards to cloning". Ars Technica. Retrieved 2017-10-25.
  2. Nemec, Matus; Sys, Marek; Svenda, Petr; Klinec, Dusan; Matyas, Vashek (November 2017). "The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli" (PDF). Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. CCS '17. doi:10.1145/3133956.3133969.
  3. Khandelwal, Swati. "Serious Crypto-Flaw Lets Hackers Recover Private RSA Keys Used in Billions of Devices". The Hacker News. Retrieved 2017-10-25.
  4. Leyden, John (16 October 2017). "Never mind the WPA2 drama... Details emerge of TPM key cockup that hits tonnes of devices". United Kingdom: The Register. Retrieved 2017-10-25.
  5. "ROCA: Infineon TPM and Secure Element RSA Vulnerability Guidance". www.ncsc.gov.uk. United Kingdom. Retrieved 2017-10-25.
  6. "ROCA: Vulnerable RSA generation (CVE-2017-15361)". Czech Republic: Centre for Research on Cryptography and Security, Faculty of Informatics, Masaryk University. Retrieved 2017-10-25.
  7. "Information on software update of RSA key generation function". Infineon Technologies AG. Retrieved 2017-10-25.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.