Vulnerabilities / Threats
2/15/2012
12:05 PM
50%
50%

Cryptographers Discover Public Key Infrastructure Flaw

Today's public key infrastructure used to secure HTTPS has security shortcomings that, in some cases, could help attackers steal data and attack servers.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The current public key infrastructure used to secure HTTPS has security shortcomings that--in some cases--could be exploited by attackers to steal data and attack servers.

That finding comes from a paper due to be presented at the Crypto 2012 conference in August in Santa Barbara, Calif. The paper was written by a team of European and American mathematicians and cryptographers, led by Dutch mathematician Arjen K. Lenstra at the Ecole Polytechnique Federale de Lausanne (EPFL) in Switzerland. The researchers published their paper early, given the severity of the vulnerabilities they discovered.

"We performed a sanity check of public keys collected on the Web," wrote the researchers in their report. "Our main goal was to test the validity of the assumption that different random choices are made each time keys are generated. We found that the vast majority of public keys work as intended."

But the researchers also discovered that public key encryption using the widely used RSA 1,024-bit algorithm is only 99.8% secure, at best, meaning that at least two out of every 1,000 public keys can be easily cracked.

[ What does the global community expect from the Internet? See Global Internet Culture Emerges. ]

"We were surprised...by the extent to which public keys are shared among unrelated parties," said the researchers. "What surprised us most is that many thousands of 1,024-bit RSA moduli, including thousands that are contained in still valid X.509 certificates, offer no security at all." Such X.509 certificates are used by certificate authorities to validate website identities, thus helping to secure everything from emails to online banking transactions.

"This comes as an unwelcome warning that underscores the difficulty of key generation in the real world," James P. Hughes, an independent Silicon Valley cryptanalyst who worked with the team, told the New York Times.

For their research, the EPFL team used data from multiple sources, including the Electronic Frontier Foundation (EFF) SSL Observatory project, which stores downloads of all publicly-visible SSL certificates on the Internet, to allow researchers to search for HTTPS vulnerabilities.

What accounts for the unexpected repetition or sharing of keys that the researchers spotted? When an RSA key is generated, it requires picking two random prime numbers that haven't been previously selected by anyone else using an RSA key. Anyone who uses the key will know these numbers, and use them--together with a public key created by the two prime numbers--to encrypt data.

To ensure that these two prime numbers don't get picked more than once, NIST recommends that anyone generating an RSA key "use a random seed of bit-length twice the intended security level," noted the researchers. "Clearly, this recommendation is not always followed."

These vulnerable keys pose serious risks to Internet security, because anyone able to identify the two prime numbers used to generate an RSA key could then bypass that key's protections. "In all cases, a weak key would allow an eavesdropper on the network to learn confidential information, such as passwords or the content of messages, exchanged with a vulnerable server," said the EFF's Dan Auerbach, a staff technologist, and Peter Eckersley, technology projects director, in a blog post. Furthermore, they said that in some cases, "sophisticated attackers could extract passwords and data from stored copies of previous encrypted sessions," or launch man-in-the-middle attacks "to inject malicious data into encrypted sessions."

The EFF said it will be working with the EPFL team to warn operators of any servers affected by the vulnerability. But the EPFL researchers have cautioned that their findings might have already been known to others. "The lack of sophistication of our methods and findings make it hard for us to believe that what we have presented is new, in particular to agencies and parties that are known for their curiosity in such matters," said the researchers. They said that their findings might also help to explain why NIST in 1991 bypassed RSA, and instead picked Digital Signature Algorithm (DSA) as its digital signature standard. Notably, DSA only requires selecting a single prime number, and the researchers found only a few cases in which two people had apparently selected the same prime number.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5427
Published: 2015-03-29
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read pa...

CVE-2014-5428
Published: 2015-03-29
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integratio...

CVE-2014-9205
Published: 2015-03-29
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.

CVE-2015-0528
Published: 2015-03-29
The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files.

CVE-2015-0996
Published: 2015-03-29
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive info...

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.