Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
summary
Claim: a faulty RSA-CRT signature exposed during the TLS ServerKeyExchange lets an attacker factor N and recover the private key even for 4096-bit certificates. The exploit requires a faulty signature Y, the known hashed-and-padded value H, and public (N,e — e often 3 or 65537). A proof-of-concept active tool HighVoltage floods handshakes until a bad signature appears and recovers the key; passive tool Pichola scans pcaps and successfully extracts keys from devices (firewalls, routers, cameras).
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:34About the topic
- 1:58Roadmap
- 3:15What is a RSA signature
- 6:45Recover a RSA private key: Prerequisites
- 7:15What if the attack is successful?
- 13:14(a) RSA Signature with RSA-CRT
- 14:03(c) Presence of faulty signature
- 15:01(b) Signature calculated on known values
- 16:44(b) PKCS 1.5 Padding
- 19:01The right ciphersuite...
- 21:20How High Voltage! works...
- 25:33How RSA works
- 26:51RSA Rule 1
- 28:39Signing with RSA-CRT
- 30:28TLS RSA-CRT Attack in "pills"
- 36:01Vulnerable crypto libraries (2)
- 39:33IKEV1 Phase 1 Main Mode (Signature Auth)
- 40:39IKEv1 Phase 1 Aggressive Mode (Signature Auth)
related talks
05mHow to defend from an attacker armed with a mathematician
45mUnlocking The Secrets Of TLS
55mUnlocking The Secrets Of TLS
28mOne&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
21mHow to defend from an attacker armed with a mathematician
44mThe DROWN Attack
49mBar-Mitzva Attack: Breaking SSL with 13-Year Old RC4 Weakness
26mThe Dangers of Key Reuse: Practical Attacks on IPsec IKE