Vulnerabilities / Threats

2/15/2012
12:05 PM
50%
50%

Cryptographers Discover Public Key Infrastructure Flaw

Today's public key infrastructure used to secure HTTPS has security shortcomings that, in some cases, could help attackers steal data and attack servers.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The current public key infrastructure used to secure HTTPS has security shortcomings that--in some cases--could be exploited by attackers to steal data and attack servers.

That finding comes from a paper due to be presented at the Crypto 2012 conference in August in Santa Barbara, Calif. The paper was written by a team of European and American mathematicians and cryptographers, led by Dutch mathematician Arjen K. Lenstra at the Ecole Polytechnique Federale de Lausanne (EPFL) in Switzerland. The researchers published their paper early, given the severity of the vulnerabilities they discovered.

"We performed a sanity check of public keys collected on the Web," wrote the researchers in their report. "Our main goal was to test the validity of the assumption that different random choices are made each time keys are generated. We found that the vast majority of public keys work as intended."

But the researchers also discovered that public key encryption using the widely used RSA 1,024-bit algorithm is only 99.8% secure, at best, meaning that at least two out of every 1,000 public keys can be easily cracked.

[ What does the global community expect from the Internet? See Global Internet Culture Emerges. ]

"We were surprised...by the extent to which public keys are shared among unrelated parties," said the researchers. "What surprised us most is that many thousands of 1,024-bit RSA moduli, including thousands that are contained in still valid X.509 certificates, offer no security at all." Such X.509 certificates are used by certificate authorities to validate website identities, thus helping to secure everything from emails to online banking transactions.

"This comes as an unwelcome warning that underscores the difficulty of key generation in the real world," James P. Hughes, an independent Silicon Valley cryptanalyst who worked with the team, told the New York Times.

For their research, the EPFL team used data from multiple sources, including the Electronic Frontier Foundation (EFF) SSL Observatory project, which stores downloads of all publicly-visible SSL certificates on the Internet, to allow researchers to search for HTTPS vulnerabilities.

What accounts for the unexpected repetition or sharing of keys that the researchers spotted? When an RSA key is generated, it requires picking two random prime numbers that haven't been previously selected by anyone else using an RSA key. Anyone who uses the key will know these numbers, and use them--together with a public key created by the two prime numbers--to encrypt data.

To ensure that these two prime numbers don't get picked more than once, NIST recommends that anyone generating an RSA key "use a random seed of bit-length twice the intended security level," noted the researchers. "Clearly, this recommendation is not always followed."

These vulnerable keys pose serious risks to Internet security, because anyone able to identify the two prime numbers used to generate an RSA key could then bypass that key's protections. "In all cases, a weak key would allow an eavesdropper on the network to learn confidential information, such as passwords or the content of messages, exchanged with a vulnerable server," said the EFF's Dan Auerbach, a staff technologist, and Peter Eckersley, technology projects director, in a blog post. Furthermore, they said that in some cases, "sophisticated attackers could extract passwords and data from stored copies of previous encrypted sessions," or launch man-in-the-middle attacks "to inject malicious data into encrypted sessions."

The EFF said it will be working with the EPFL team to warn operators of any servers affected by the vulnerability. But the EPFL researchers have cautioned that their findings might have already been known to others. "The lack of sophistication of our methods and findings make it hard for us to believe that what we have presented is new, in particular to agencies and parties that are known for their curiosity in such matters," said the researchers. They said that their findings might also help to explain why NIST in 1991 bypassed RSA, and instead picked Digital Signature Algorithm (DSA) as its digital signature standard. Notably, DSA only requires selecting a single prime number, and the researchers found only a few cases in which two people had apparently selected the same prime number.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11232
PUBLISHED: 2018-05-18
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVE-2017-15855
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in u...
CVE-2018-3567
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.
CVE-2018-3568
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.
CVE-2018-5827
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.