Cryptology ePrint Archive: Report 2020/1151

Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E)

Robert Merget and Marcus Brinkmann and Nimrod Aviram and Juraj Somorovsky and Johannes Mittmann and Jörg Schwenk

Abstract: Diffie-Hellman key exchange (DHKE) is a widely adopted method for exchanging cryptographic key material in realworld protocols like TLS-DH(E). Past attacks on TLS-DH(E) focused on weak parameter choices or missing parameter validation. The confidentiality of the computed DH share, the premaster secret, was never questioned; DHKE is used as a generic method to avoid the security pitfalls of TLS-RSA. We show that due to a subtle issue in the key derivation of all TLS-DH(E) cipher suites in versions up to TLS 1.2, the premaster secret of a TLS-DH(E) session may, under certain circumstances, be leaked to an adversary. Our main result is a novel side-channel attack, named Raccoon attack, which exploits a timing vulnerability in TLS-DH(E), leaking the most significant bits of the shared Diffie-Hellman secret. The root cause for this side channel is that the TLS standard encourages non-constant-time processing of the DH secret. If the server reuses ephemeral keys, this side channel may allow an attacker to recover the premaster secret by solving an instance of the Hidden Number Problem. The Raccoon attack takes advantage of uncommon DH modulus sizes, which depend on the properties of the used hash functions. We describe a fully feasible remote attack against an otherwisesecure TLS configuration: OpenSSL with a 1032-bit DH modulus. Fortunately, such moduli are not commonly used on the Internet. Furthermore, with our large-scale scans we have identified implementation-level issues in production-grade TLS implementations that allow for executing the same attack by directly observing the contents of server responses, without resorting to timing measurements.

Category / Keywords: cryptographic protocols / tls, hash functions, diffie-hellman key exchange, hidden number problem

Original Publication (with major differences): 30th USENIX Security Symposium (USENIX Security '21 Summer)

Date: received 21 Sep 2020

Contact author: marcus brinkmann at rub de,robert merget@rub de,nimrod aviram@gmail com,juraj somorovsky@upb de,joerg schwenk@rub de,johannes mittmann@bsi bund de

Available format(s): PDF | BibTeX Citation

Version: 20200925:183659 (All versions of this report)

Short URL: ia.cr/2020/1151


[ Cryptology ePrint archive ]