Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Cryptographers Discover Public Key Infrastructure Flaw

Today's public key infrastructure used to secure HTTPS has security shortcomings that, in some cases, could help attackers steal data and attack servers.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The current public key infrastructure used to secure HTTPS has security shortcomings that--in some cases--could be exploited by attackers to steal data and attack servers.

That finding comes from a paper due to be presented at the Crypto 2012 conference in August in Santa Barbara, Calif. The paper was written by a team of European and American mathematicians and cryptographers, led by Dutch mathematician Arjen K. Lenstra at the Ecole Polytechnique Federale de Lausanne (EPFL) in Switzerland. The researchers published their paper early, given the severity of the vulnerabilities they discovered.

"We performed a sanity check of public keys collected on the Web," wrote the researchers in their report. "Our main goal was to test the validity of the assumption that different random choices are made each time keys are generated. We found that the vast majority of public keys work as intended."

But the researchers also discovered that public key encryption using the widely used RSA 1,024-bit algorithm is only 99.8% secure, at best, meaning that at least two out of every 1,000 public keys can be easily cracked.

[ What does the global community expect from the Internet? See Global Internet Culture Emerges. ]

"We were surprised...by the extent to which public keys are shared among unrelated parties," said the researchers. "What surprised us most is that many thousands of 1,024-bit RSA moduli, including thousands that are contained in still valid X.509 certificates, offer no security at all." Such X.509 certificates are used by certificate authorities to validate website identities, thus helping to secure everything from emails to online banking transactions.

"This comes as an unwelcome warning that underscores the difficulty of key generation in the real world," James P. Hughes, an independent Silicon Valley cryptanalyst who worked with the team, told the New York Times.

For their research, the EPFL team used data from multiple sources, including the Electronic Frontier Foundation (EFF) SSL Observatory project, which stores downloads of all publicly-visible SSL certificates on the Internet, to allow researchers to search for HTTPS vulnerabilities.

What accounts for the unexpected repetition or sharing of keys that the researchers spotted? When an RSA key is generated, it requires picking two random prime numbers that haven't been previously selected by anyone else using an RSA key. Anyone who uses the key will know these numbers, and use them--together with a public key created by the two prime numbers--to encrypt data.

To ensure that these two prime numbers don't get picked more than once, NIST recommends that anyone generating an RSA key "use a random seed of bit-length twice the intended security level," noted the researchers. "Clearly, this recommendation is not always followed."

These vulnerable keys pose serious risks to Internet security, because anyone able to identify the two prime numbers used to generate an RSA key could then bypass that key's protections. "In all cases, a weak key would allow an eavesdropper on the network to learn confidential information, such as passwords or the content of messages, exchanged with a vulnerable server," said the EFF's Dan Auerbach, a staff technologist, and Peter Eckersley, technology projects director, in a blog post. Furthermore, they said that in some cases, "sophisticated attackers could extract passwords and data from stored copies of previous encrypted sessions," or launch man-in-the-middle attacks "to inject malicious data into encrypted sessions."

The EFF said it will be working with the EPFL team to warn operators of any servers affected by the vulnerability. But the EPFL researchers have cautioned that their findings might have already been known to others. "The lack of sophistication of our methods and findings make it hard for us to believe that what we have presented is new, in particular to agencies and parties that are known for their curiosity in such matters," said the researchers. They said that their findings might also help to explain why NIST in 1991 bypassed RSA, and instead picked Digital Signature Algorithm (DSA) as its digital signature standard. Notably, DSA only requires selecting a single prime number, and the researchers found only a few cases in which two people had apparently selected the same prime number.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26120
PUBLISHED: 2020-09-27
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even witho...
CVE-2020-26121
PUBLISHED: 2020-09-27
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an uploa...
CVE-2020-25812
PUBLISHED: 2020-09-27
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
CVE-2020-25813
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
CVE-2020-25814
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> ...