Subject: [IPsec] Yet another RFC-5114 attack

From: Paul Wouters <[email-masked]>
Date: Tue, 18 Oct 2016 09:59:49 -0400 (EDT)

https://eprint.iacr.org/2016/995.pdf

 	Several recent standards, including NIST SP 800- 56A and RFC
 	5114, advocate the use of “DSA” parameters for Diffie-Hellman
 	key exchange. While it is possible to use such parameters
 	securely, additional validation checks are necessary to
 	prevent well-known and potentially devastating attacks. In this
 	paper, we observe that many Diffie-Hellman implementations do
 	not properly validate key exchange inputs. Combined with other
 	protocol properties and implementation choices, this can radically
 	decrease security. We measure the prevalence of these parameter
 	choices in the wild for HTTPS, POP3S, SMTP with STARTTLS,
 	SSH, IKEv1, and IKEv2, finding millions of hosts using
 	DSA and other non-“safe” primes for Diffie-Hellman
 	key exchange, many of them in combination with potentially
 	vulnerable behaviors. We examine over 20 open-source cryptographic
 	libraries and applications and observe that until January 2016,
 	not a single one validated subgroup orders by default.

This paper also actually understood the difficulties of IKE scanning!
And kudos to the authors for looking into so much deployment and open
source software!

Paul

---

From: Peter Gutmann <[email-masked]>
Date: Sun, 23 Oct 2016 11:32:56 +0000

And another one:

  http://eprint.iacr.org/2016/999.pdf

  Indiscreet Logs: Persistent Diffie-Hellman Backdoors in TLS

  Software implementations of discrete logarithm based cryptosystems over
  finite fields typically make the assumption that any domain parameters they
  are presented with are trustworthy, i.e., the parameters implement cyclic
  groups where the discrete logarithm problem is assumed to be hard. An
  informal and widespread justification for this seemingly exists that says
  validating parameters at run time is too computationally expensive relative
  to the perceived risk of a server sabotaging the privacy of its own
  connection. In this paper we explore this trust assumption and examine
  situations where it may not always be justified.

  We conducted an investigation of discrete logarithm domain parameters in use
  across the Internet and discovered evidence of a multitude of potentially
  backdoored moduli of unknown order in TLS and STARTTLS spanning numerous
  countries, organizations, and protocols. Although our disclosures resulted
  in a number of organizations taking down suspicious parameters, we argue the
  potential for TLS backdoors is systematic and will persist until either
  until better parameter hygiene is taken up by the community, or finite field
  based cryptography is eliminated altogether.

This problem at least:

  No mechanism is provided in TLS to communicate group order

is already fixed:

  https://datatracker.ietf.org/doc/draft-gutmann-tls-lts/

Peter.