Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS
summary
Investigates GCM nonce misuse in TLS, demonstrates a Joux-style forgery that recovers the GCM authentication subkey when an 8‑byte nonce repeats, and builds a JavaScript-driven proof‑of‑concept that injects content into live HTTPS sessions; Internet scan finds ~70,000 hosts using random nonces and 184 servers repeating nonces in short connections, identifies affected vendor products, supplies exploit code and an online tester, and reports that vendor patches and advisories are issued for many affected devices while the PoC injection works against vulnerable targets.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 0:50Getting Started
- 1:50TLS Encryption
- 2:20symmetric encryption
- 3:55lucky 13 attack
- 5:00RC4 attack
- 5:45GCM
- 7:05Other cryptographers
- 7:55Adam Langley
- 10:10TLS specification
- 11:05Scanning the Internet
- 11:35Tracking Devices
- 13:10Radware
- 13:50Devices
- 14:20Sign For
- 14:40OpenSSL 101
- 16:30Attack Description
- 17:35GCM Background
- 18:40GCM Authentication
- 19:45Highlevel attackers
- 20:40Lowlevel attackers
- 23:40Nonce reuse
- 24:45Fully known polynomial
- 25:10Application in TLS
- 27:45GCM stream cipher
- 29:40Changing the HTML response
- 30:05Attacking the same domain
- 31:20Future trends
- 33:40Conclusion
- 35:55GitHub
- 36:50Session Key
- 39:00Problems with GCM
- 41:35Weak keys in GCM
- 45:10What can we bring to hardware vendors
related talks
54mBroken Crypto is Broken
30mMy code is being hacked!
53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP
14mPractical Attacks on a Decentralized Secure Messenger Session
24mA Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
26mConstant-Time Callees with Variable-Time Callers
01h 09mSpecial Session II
01h 01mBroken crypto is broken