On the Practical Exploitability of Dual EC in TLS Implementations

By Stephen Checkoway, Matthew Fredrikson, Ruben Niederhagen, Adam Everspaugh, Matthew Green, Tanja Lange, Ristenpart, Daniel J. Bernstein, Jake Maskiewicz, and Hovav Shacham.

In Proceedings of USENIX Security 2014. USENIX, August 2014.

Abstract

This paper analyzes the actual cost of attacking TLS implementations that use NIST’s Dual EC pseudorandom number generator, assuming that the attacker generated the constants used in Dual EC. It has been known for several years that an attacker generating these constants and seeing a long enough stretch of Dual EC output bits can predict all future outputs; but TLS does not natu- rally provide a long enough stretch of output bits, and the cost of an attack turns out to depend heavily on choices made in implementing the RNG and on choices made in implementing other parts of TLS.

Specifically, this paper investigates OpenSSL-FIPS, Windows’ SChannel, and the C/C++ and Java versions of the RSA BSAFE library. This paper shows that Dual EC exploitability is fragile, and in particular is stopped by an outright bug in the certified Dual EC implementation in OpenSSL. On the other hand, this paper also shows that Dual EC exploitability benefits from a modification made to the Dual EC standard in 2007; from several attack optimizations introduced here; and from various proposed TLS extensions, one of which is implemented in BSAFE, though disabled in the version we obtained and stud- ied. The paper’s attacks are implemented; benchmarked; tested against libraries modified to use new Dual EC constants; and verified to successfully recover TLS plaintext.

Material

Reference

@InProceedings{checkoway-et-al:dualec:usenix14,
  author =    {Stephen Checkoway and Matthew Fredrikson and Ruben
               Niederhagen and Adam Everspaugh and Matthew Green and
               Tanja Lange and Thomas Ristenpart and Daniel J.
               Bernstein and Jake Maskiewicz and Hovav Shacham},
  title =     {On the Practical Exploitability of {Dual~EC} in {TLS}
               Implementations},
  booktitle = {Proceedings of the USENIX Security Symposium 2014, (\textbf{USENIX})},
  editor =    {Kevin Fu},
  publisher = {USENIX},
  year =      2014,
  month =     aug,
  url =       {https://checkoway.net/papers/dualec2014},
}