How to Backdoor Diffie-Hellman
•
0 j'aime•737 vues
Lately, several backdoors in cryptographic constructions, protocols and implementations have been surfacing in the wild: Dual-EC in RSA's B-Safe product, a modified Dual-EC in Juniper's operating system ScreenOS and a non-prime modulus in the open-source tool socat. Many papers have already discussed the fragility of cryptographic constructions not using nothing-up-my-sleeve numbers, as well as how such numbers can be safely picked. However, the question of how to introduce a backdoor in an already secure, safe and easy to audit implementation has so far rarely been researched (in the public). We present two ways of building a Nobody-But-Us (NOBUS) Diffie-Hellman backdoor: a composite modulus with a hidden subgroup (CMHS) and a composite modulus with a smooth order (CMSO). We then explain how we were able to subtly implement and exploit it in a local copy of an open source library using the TLS protocol.
Recommandé
Contenu connexe
Tendances
Tendances (12)
En vedette
En vedette (11)
Similaire à How to Backdoor Diffie-Hellman
Similaire à How to Backdoor Diffie-Hellman (20)
Dernier
Dernier (20)
How to Backdoor Diffie-Hellman
- 1. HOW TO BACKDOOR DIFFIE-HELLMANDavid Wong NCC Group
- 2. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 3. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 5. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 6. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 8. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https / Snowden leaks 2014: preloaded-HSTS introduced in Chrome
- 9. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https / Snowden leaks 2010/2014: preloaded-HSTS introduced in Chrome
- 12. Logjam
- 13. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 18. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 19. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 20. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 21. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 22. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 23. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 25. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 26. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 27. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 28. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 29. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 30. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 31. • Weak crypto • Kleptography
- 32. Dual EC
- 33. 2007
- 34. CRYPTO 2007
- 35. NSA’s BULLRUN
- 39. Dual EC is obvious.
- 40. • Weak crypto • Kleptography • New Backdoored Algorithms
- 43. DHE backdoor?
- 44. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 45. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 46. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 52. Agenda 1. Group Theory 2. Attacks on DH 3. Construct a backdoor 4. Construct a NOBUS backdoor
- 53. Known attacks against DHGroup Theory
- 54. Known attacks against DHGroup Theory Alice’s
- 55. Known attacks against DHPohlig-HellmanGroup Theory
- 56. Known attacks against DHPohlig-HellmanGroup Theory
- 57. Known attacks against DHPohlig-HellmanGroup Theory
- 58. Known attacks against DHPohlig-HellmanGroup Theory
- 59. Known attacks against DHPohlig-HellmanGroup Theory
- 60. Known attacks against DHPohlig-HellmanGroup Theory
- 61. Known attacks against DHPohlig-HellmanGroup Theory
- 62. Known attacks against DHPohlig-HellmanGroup Theory
- 64. Known attacks against DH
- 65. Known attacks against DHDiffie-HellmanKnown attacks against DH
- 66. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 67. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 68. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 69. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 70. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 74. Small Subgroups Attack alice odd even
- 75. Known attacks against DHPohlig-Hellman
- 76. Known attacks against DHPohlig-Hellman
- 77. Prime groups
- 78. Prime groups
- 79. Prime groups
- 80. Prime groups
- 81. CM-HSO Composite Modulus with a Hidden Smooth Order
- 82. CM-HSO Composite Modulus with a Hidden Smooth Order
- 83. CM-HSO Composite Modulus with a Hidden Smooth Order
- 84. CM-HSO Composite Modulus with a Hidden Smooth Order
- 87. DEMO
- 89. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome -> deprecating DHE • migrating to ECDHE
- 90. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome -> deprecating DHE • migrating to ECDHE
- 91. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome deprecating DHE (-> ECDHE) • migrating to ECDHE
- 92. END how many VPN/libraries/closed-source products are backdoored?
- 93. END how many VPN/libraries/closed-source products are backdoored? what about ECDHE?