How to defend from an attacker armed with a mathematician
summary
OpenSSL reuses the DH ephemeral exponent, accepts attacker-supplied group parameters without validation, and ships support for RFC 5114 groups whose p−1 factors include many small primes. An attacker sends crafted generators, gets residues of the server secret modulo small primes, reconstructs the full secret with the Chinese remainder theorem, and fully recovers keys without any memory bug. This is reported as CVE-2016-0701 and is fixed in OpenSSL in January 2016.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:13About me
- 1:18What is TLS
- 1:40How does TLS work
- 2:59What are the actors looking into
- 3:20Dont get dependent
- 3:31What we need to know
- 4:04Public key cryptography
- 4:41Discrete log function
- 7:35Analogic logarithm
- 8:04How HTTPS works
- 10:01Openssl vulnerability
- 10:52Openssl mistakes
- 11:37Openssl validation
- 12:08Safe primes
- 13:50I look weird
- 14:23I can screw this
- 14:42F35114
- 15:34HP5114
- 16:10Question
related talks
01h 13mHow Diffie-Hellman Fails in Practice
28mOne&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
51mA Retrospective on the Use of Export Cryptography
42mRecover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
55mUnlocking The Secrets Of TLS
26mConstant-Time Callees with Variable-Time Callers
56mAsymmetric Encryption: A Deep Dive
52mAsymmetric Encryption: A Deep Dive