Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passive SSH Key Compromise via Lattices [pdf]

eprint.iacr.org

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Passive SSH Key Compromise via Lattices [pdf]

#51

Post by magicalhippo »

GTP wrote: post #8
magicalhippo wrote: post #4

RSA digital signatures can reveal a signer’s secret key if a computational or hardware fault occurs during signing with an unprotected implementation using the Chinese Remainder Theorem and a deterministic padding scheme like PKCS#1 v1.5. [...] In this context, a passive adversary can quietly monitor legitimate connections without risking detection until they observe a faulty signature that exposes the private key. T…

Crypto is hard, and part of the hardness is implementing it correctly.

Yea I forgot the sarcasm tag there.

My point was exactly that, it's bloody hard. Not only implementing it correctly, but all the non-obvious ways it can go wrong that'spartially out of your control due to non-ideal hardware (in the mathematical sense). Timing attacks, cache leaks, speculation leaks, this...

Re: Passive SSH Key Compromise via Lattices [pdf]

#52

Post by magicalhippo »

timschmidt wrote: post #33
GTP wrote: post #8

Earlier quoted context omitted.

Crypto is hard, and part of the hardness is implementing it correctly.

I think GP's point is that one vulnerable hardware or software implementation in the entire network of implementations being passively observed by the attacker can reveal the private keys. So it's not just your implementations which must be perfect, but all your neighbors, and all theirs too.

I read it as "only" the signing machine needs faulty hardware. Still, bit errors occur, even with ECC, and this allows for a passive hence very unobtrusive attack.

Re: Passive SSH Key Compromise via Lattices [pdf]

#53

Post by viraptor »

hannob wrote: post #15

To give some easier explanation: This is an attack against faulty RSA implementations. There is a common optimization in RSA signature implementations that splits up an expensive mathematical operation into two smaller operations. If one of these throws out a bad result then you can break the key. Why does this happen? Multiple reasons. Implementations of big number math can and does contain bugs. (I used to hunt for…

> I used to hunt for those via fuzzing

That's such an obvious-in-hindsight idea. I love it.

Re: Passive SSH Key Compromise via Lattices [pdf]

#54

Post by zwp »

tptacek wrote: post #29

Headlines: * In (rare) vulnerable targets, this allows you to recover the host's key, and thus impersonate a host. You can't compromise client credentials with this attack, since client credentials are exchanged after the (active) secure channel is established. If you can impersonate a host, as this attack would allow you to do, you could capture client password credentials, and you can drive a forwarded agent. * Ope…

> whatever "SSH-2.0-SSHD" is (the authors don't know either)

I think this is from the j2ssh/maverick SSH server, used in a bunch of enterprisey Java products.

https://jadaptive.com/en/products/java-ssh-server

https://github.com/sshtools/j2ssh-maverick/blob/ce11ceaf0aa0...

Re: Passive SSH Key Compromise via Lattices [pdf]

#55

Post by upofadown »

tptacek wrote: post #45
upofadown wrote: post #39

Earlier quoted context omitted.

The attack I linked to discussed completely theoretical attacks. No examples were provided. The attack we are commenting on does provide an example. In context it it obvious that I was addressing the contention that the paper I linked to had something to do with an implementation error.

Yes, examples of the attack you dismissed . And you cited it as evidence on this thread about that attack . It's just very funny, is all.

OK, thanks. I have updated the article to remove the term "theoretical" and have added an appropriate footnote that references the new work.

Re: Passive SSH Key Compromise via Lattices [pdf]

#56

Post by tptacek »

upofadown wrote: post #55
tptacek wrote: post #45

Earlier quoted context omitted.

Yes, examples of the attack you dismissed . And you cited it as evidence on this thread about that attack . It's just very funny, is all.

OK, thanks. I have updated the article to remove the term "theoretical" and have added an appropriate footnote that references the new work.

This is still wrong! Leaving aside that hardware faults are themselves implementation pitfalls for RSA, the fundamental failure here is a software implementation flaw. You really need to understand these attacks before you supply guidance about them.

Re: Passive SSH Key Compromise via Lattices [pdf]

#57

Post by gonzo »

sebstefan wrote: post #25
mackman wrote: post #9

Earlier quoted context omitted.

Does each bit flip reveal a bit or less or does somehow a single flip compromise the entire key?

It's akin to me having the secret number 17, giving you 221 (17*13) and then, during a solar flare, fucking it up once and giving you 187 (17*11). You know that the numbers are the product of a multiplication, and you know that a common factor is my private secret number. You figure out that the only way to get to 187 and 221 while keeping a common factor is if that factor is 17. That's just computing the GCD. >An RS…

you have to flip two bits to get from 13 (1101) to 11 (1011).
Post reply on HN