The Return of Coppersmith's Attack: Practical Factorization of Widely ... · The Return of...
12
The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli ACM CCS’17, Dallas, TX, USA Matus Nemec 1,2 Marek Sys 1 Petr Svenda 1 Dusan Klinec 3,1 Vashek Matyas 1 1 Masaryk University 2 Ca’ Foscari University 3 Enigma Bridge Brno, Czech Republic Venice, Italy Cambridge, UK
Transcript of The Return of Coppersmith's Attack: Practical Factorization of Widely ... · The Return of...
The Return of Coppersmith’s Attack:Practical Factorization of Widely Used RSA ModuliACM CCS’17, Dallas, TX, USA
Matus Nemec1,2 Marek Sys1 Petr Svenda1 Dusan Klinec3,1 Vashek Matyas1
1Masaryk University 2Ca’ Foscari University 3Enigma BridgeBrno, Czech Republic Venice, Italy Cambridge, UK
Contributions roca.crocs.fi.muni.cz
Structure of RSA primes in library of Infineon TechnologiesApplication of Coppersmith’s factorization methodAnalysis of impacted domains, including eID, TPM, tokensand other NIST FIPS 140-2 and CC EAL 5+ certified devicesLessons learned and mitigation
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 2 / 12
Motivation roca.crocs.fi.muni.czThe Million-Key Question: Investigating the Origins of RSA Public Keys
USENIX Security 2016
Library: Microsoft CryptoAPI
P
Q
2k−1 2k
2k−1
2k
Card: Infineon JTOP 80K
P
Q
2k−1 2k
2k−1
2k@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 3 / 12
Motivation roca.crocs.fi.muni.czThe Million-Key Question: Investigating the Origins of RSA Public Keys
USENIX Security 2016Distribution of RSA keys modulo small primes:
5 10 15Remainder
0.06
0.07
0.08
0.09
0.10
Prob
abilit
y
Random primesModulo
11131719
5 10 15Remainder
0.0
0.1
0.2
0.3
0.4
0.5
Prob
abilit
y
InfineonModulo
11131719
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 4 / 12
Vulnerable RSA keys roca.crocs.fi.muni.cz
N = p ∗ qpideal = random prime
pInfineon = (k ∗M + 65537a mod M); a, k ∈ ZM = 2 ∗ 3 ∗ 5 ∗ 7 ∗ · · · ∗ Pn
Consequences of the structure:1. Fingerprint Entropy in a prime2. Entropy loss Infineon: a k determined by the structure
3. Factorization is possible Random: random bits
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 5 / 12
Coppersmith’s method as a black-box tool roca.crocs.fi.muni.cz
Coppersmith: Partial knowledge of private key ⇒ full private key
1. Modulus N (known)
2. Unknown factors *p (unknown) q (unknown)
3. Partial knowledge of prime p **phigh plow q (unknown)
4. Apply Coppersmith’s attack Coppersmith's method
p (known)@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 6 / 12
Coppersmith’s attack applied on Infineon primes roca.crocs.fi.muni.cz
p = k ∗M + 65537a mod MGuess a and compute k using Coppersmith’s method
a
k 65537a mod M256 bits
54 bits 970 bits
1024-bit prime
a is still too large – find a smaller M ′ (divisor of M)512 bits: bound on known bits
for Coppersmith's methoda′
k ′ 65537a′ mod M ′35 bits
470 bits 554 bits@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 7 / 12
Attack complexity roca.crocs.fi.muni.cz
512 1024 1536 2048 2560 3072 3584 4096Key size [bits]
105
1015
1025
1035
1045
1055
1065
1075W
orst
cas
e fa
ctor
izatio
n tim
e [y
ears
] M1 M2 M3 M4
3936Worst case factorization time512-bit: 2 CPU hours1024-bit: 2 CPU months ($76 on AWS)2048-bit: 100 CPU years ($40.300 on AWS)No practical attack
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 8 / 12
Impacts roca.crocs.fi.muni.czIdentity documents(eID, eHealth cards)
Authenticationtokens
Programmablesmartcards
Affectedchip
RSALibrary
Programmable
TPM
Trusted Platform Modules(Data encryption,Platform integrity)
Message protection(S-MIME, PGP) Software signing Secure browsing*
(TLS/HTTPS)
*only a small number of vulnerable keys found
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 9 / 12
Mitigations roca.crocs.fi.muni.cz
Test public keys for fingerprint at roca.crocs.fi.muni.czRevoke certificates of weak keys (services become unavailable)Change algorithm, e.g. ECC (must update infrastructure)Generate new, secure keys:
Firmware update (uncommon), replace the device (costly)Import a secure keypair (requires trusted environment)
Temporarily switch to less affected key lengths (e.g., 3936-bit)Significantly reduced security level, attack may improve
Additional risk management when a vulnerable key is detected
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 10 / 12
Attack timeline roca.crocs.fi.muni.cz
End of Jan: Proof of Concept attack
Feb 1st: Infineon notified
Oct 10th: Microsoft Patch Tuesday
Oct 16th: Public disclosure
Oct 23rd: Tanja Lange & Daniel J.Bernstein announced a faster attack
Vulnerable devices from 2007 found
Oct 30th: Full paper published
Daniel J. Bernstein@hashbreaker
Chicago, Illinois
cr.yp.to/djb.html
Joined July 2009
Tweet to Daniel J. Bernstein
4 Followers you know
Photos and videos
Daniel J. Bernstein @hashbreaker · 18h
Wait: @matthew_d_green named DUHK "Attack of the week" on _Monday_?
Top-10-attacks-this-week judges meet on Fridays!
Attack of the week: DUHK
Before we get started, fair warning: this is going to be apost about a fairly absurd (but non-trivial!) attack oncryptographic systems. But that’s ok, because it’s ba...
blog.cryptographyengineering.com
2 9 30
Daniel J. Bernstein @hashbreaker · Oct 23
Replying to @graham_steel
Yup. Our 2048bit attack using @sagemath is now 5-25% faster than ROCA blog.
3fd6a53a3b6362248ac10de4a8108df3c839a7193a96d0991c6675990599d917
16 33
Daniel J. Bernstein @hashbreaker · Oct 21
Replying to @hyperelliptic
More exploration with @hyperelliptic has now produced working attack code:
3f5ba89d705a1059683c4c406dcda87f8af73f37cf0202cc74b875fcc28b3cb6
11
Daniel J. Bernstein @hashbreaker · Oct 17
New blog post "Quantum algorithms to find collisions" blog.cr.yp.to/20171017-
colli…: Analysis of several algorithms for collisions and preimages.
1 53 57
Daniel J. Bernstein Retweeted
Tanja Lange @hyperelliptic · Oct 17
Had fun reverse engineering github.com/crocs-muni/roc… w/ @hashbreaker
SHA256:
01463fbab8a8f9e345cd3f2201556a26d2f81b03cf2b8760643148b9a01255a6
crocs-muni/roca
ROCA: Infineon RSA vulnerability. Contribute to rocadevelopment by creating an account on GitHub.
github.com
4 29 71
Tweets Tweets & replies Media
Tweets
1,135Following
19Followers
16.2KLikes
27 Following
Home Notifications Messages Search Twitter Tweet
Graham Steel @graham_steel · Oct 17
I guess that was inevitable... will they have a faster version of the attack before
the paper is even released?
Had fun reverse engineering github.com/crocs-muni/roc… w/ @hashbreaker SHA256: 01463fbab8a8f9e345cd3f2201556a26d2f81b03cf2b8760643148b9a01255a6
2 2 14
16 Retweets 33 Likes
Daniel J. Bernstein @hashbreaker
Replying to @graham_steel
Yup. Our 2048bit attack using @sagemath is now 5-25% faster than ROCA blog. 3fd6a53a3b6362248ac10de4a8108df3c839a7193a96d0991c6675990599d91712:34 AM - 23 Oct 2017
Following
16 33
Tweet your reply
Tanja Lange @hyperelliptic
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 11 / 12
Conclusions roca.crocs.fi.muni.cz
Optimizations may weaken securitySecret design ⇒ delayed discovery of flaws ⇒ increased impactsReconsider the certification processPrevent a single point of failure
Secure multi-party computationCollaborative RSA
Thank you for your attention
@CRoCS_MUNI | [email protected] The Return of Coppersmith’s Attack November 2, 2017 12 / 12
