### The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations

Eyal Ronen, Robert Gillham, Daniel Genkin, Adi Shamir, David Wong, and Yuval Yarom

##### Abstract

At CRYPTO’98, Bleichenbacher published his seminal paper which described a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5 standard. Over the last twenty years researchers and implementors had spent a huge amount of effort in developing and deploying numerous mitigation techniques which were supposed to plug all the possible sources of Bleichenbacher-like leakages. However, as we show in this paper most implementations are still vulnerable to several novel types of attack based on leakage from various microarchitectural side channels: Out of nine popular implementations of TLS that we tested, we were able to break the security of seven implementations with practical proof-of-concept attacks. We demonstrate the feasibility of using those Cache-like ATacks (CATs) to perform a downgrade attack against any TLS connection to a vulnerable server, using a BEAST-like Man in the Browser attack. The main difficulty we face is how to perform the thousands of oracle queries required before the browser’s imposed timeout (which is 30 seconds for almost all browsers, with the exception of Firefox which can be tricked into extending this period). The attack seems to be inherently sequential (due to its use of adaptive chosen ciphertext queries), but we describe a new way to parallelize Bleichenbacher-like padding attacks by exploiting any available number of TLS servers that share the same public key certificate. With this improvement, we could demonstrate the feasibility of a downgrade attack which could recover all the 2048 bits of the RSA plaintext (including the premaster secret value, which suffices to establish a secure connection) from five available TLS servers in under 30 seconds. This sequential-to-parallel transformation of such attacks can be of independent interest, speeding up and facilitating other side channel attacks on RSA implementations.

Available format(s)
Publication info
Published elsewhere. To appear in the IEEE Symposium on Security & Privacy, May 2019
Keywords
TLSBleichenbacherSide-channels
Contact author(s)
er @ eyalro net
eyal ronen @ cs tau ac il
History
2019-02-06: revised
See all versions
Short URL
https://ia.cr/2018/1173

CC BY

BibTeX

@misc{cryptoeprint:2018/1173,
author = {Eyal Ronen and Robert Gillham and Daniel Genkin and Adi Shamir and David Wong and Yuval Yarom},
title = {The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations},
howpublished = {Cryptology ePrint Archive, Paper 2018/1173},
year = {2018},
note = {\url{https://eprint.iacr.org/2018/1173}},
url = {https://eprint.iacr.org/2018/1173}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.