Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
1–10 of 69 posts
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#2> The cat is not dead yet, with two lives remaining thanks to BearSSL (developed by my colleague Thomas Pornin) and Google's BoringSSL.
Some kind of award has to go to this sentence, that has to be the most convoluted way to simply say "aren't vulnerable."
In context you can only just barely follow it, and it literally involves counting the vulnerable + un-vulnerable libraries to check they all add up to 9...
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#3> The last 20 years of attacks that have been re-discovering Bleichenbacher's seminal work in 1998 clearly show that it is close to impossible to correclty implement the RSA PKCS#1 v1.5 encryption scheme. While our paper recommends a series of mitigations, it is time for RSA PKCS#1 v1.5 to be deprecated and replaced by more modern schemes like OAEP and ECEIS for asymmetric encryption or Elliptic Curve Diffie-Hellman for key exchanges.
RSA PKCS#1 v1.5: https://tools.ietf.org/html/rfc2313
Title: PKCS #1: RSA Encryption version 1.5
tl;dr: deprecate RSA encryption as a whole?! Did I read this right?
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#4Is LibreSSL affected?
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#5> The last 20 years of attacks that have been re-discovering Bleichenbacher's seminal work in 1998 clearly show that it is close to impossible to correclty implement the RSA PKCS#1 v1.5 encryption scheme. While our paper recommends a series of mitigations, it is time for RSA PKCS#1 v1.5 to be deprecated and replaced by more modern schemes like OAEP and ECEIS for asymmetric encryption or Elliptic Curve Diffie-Hellman…
The consensus among cryptographers for quite a while now has been that RSA should be avoided. Implementation vulnerabilities in RSA aren't surprising, and it's a poor choice of algorithm for modern cryptosystems.
However, note that much of the problem with implementing RSA correctly is the padding. The specific recommendation here is to only use RSA OAEP, and preferably to abandon RSA altogether for more modern (elliptic curve) constructions.
So no, they're not saying to deprecate RSA in its entirety (though I have high confidence all of the authors would strongly suggest that to anyone who asked). Rather, they're saying you should only use RSA with one very specific form of padding, if you absolutely insist on using RSA in 2019 (and you shouldn't unless you know you have to).
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#6Is LibreSSL affected?
LibreSSL was not among the 9 libraries tested.
Nevertheless, it is likely that LibreSSL has not replaced yet this part of complex code inherited from OpenSSL. In that case, LibreSSL would also be vulnerable.
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#7Is LibreSSL affected?
[deleted]
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#8Is LibreSSL affected?
Good question. The paper is here[1] but there is no mention of LibreSSL.
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#9Is BouncyCastle affected?
Re: Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries
#10Jesus. Imagine being enough of a genius to actually write timing-safe code.