Sunday, January 21, 2024

Practical Bleichenbacher Attacks On IPsec IKE

We found out that reusing a key pair across different versions and modes of IPsec IKE can lead to cross-protocol authentication bypasses, enabling the impersonation of a victim host or network by attackers. These vulnerabilities existed in implementations by Cisco, Huawei, and others.

This week at the USENIX Security conference, I will present our research paper on IPsec attacks: The Dangers of Key Reuse: Practical Attacks on IPsec IKE written by Martin Grothe, Jörg Schwenk, and me from Ruhr University Bochum as well as Adam Czubak and Marcin Szymanek from the University of Opole [alternative link to the paper]. This blog post is intended for people who like to get a comprehensive summary of our findings rather than to read a long research paper.

IPsec and Internet Key Exchange (IKE)

IPsec enables cryptographic protection of IP packets. It is commonly used to build VPNs (Virtual Private Networks). For key establishment, the IKE protocol is used. IKE exists in two versions, each with different modes, different phases, several authentication methods, and configuration options. Therefore, IKE is one of the most complex cryptographic protocols in use.

In version 1 of IKE (IKEv1), four authentication methods are available for Phase 1, in which initial authenticated keying material is established: Two public key encryption based methods, one signature based method, and a PSK (Pre-Shared Key) based method.

Attacks on IKE implementations

With our attacks we can impersonate an IKE device: If the attack is successful, we share a set of (falsely) authenticated symmetric keys with the victim device, and can successfully complete the handshake – this holds for both IKEv1 and IKEv2. The attacks are based on Bleichenbacher oracles in the IKEv1 implementations of four large network equipment manufacturers: Cisco, Huawei, Clavister, and ZyXEL. These Bleichenbacher oracles can also be used to forge digital signatures, which breaks the signature based IKEv1 and IKEv2 variants. Those who are unfamiliar with Bleichenbacher attacks may read this post by our colleague Juraj Somorovsky for an explanation.

The affected hardware test devices by Huawei, Cisco, and ZyXEL in our network lab.

We show that the strength of these oracles is sufficient to break all handshake variants in IKEv1 and IKEv2 (except those based on PSKs) when given access to powerful network equipment. We furthermore demonstrate that key reuse across protocols as implemented in certain network equipment carries high security risks.

We additionally show that both PSK based modes can be broken with an offline dictionary attack if the PSK has low entropy. Such an attack was previously only documented for one of those modes (edit: see this comment). We thus show attacks against all authentication modes in both IKEv1 and IKEv2 under reasonable assumptions.

The relationship between IKEv1 Phase 1, Phase 2, and IPsec ESP. Multiple simultaneous Phase 2 connections can be established from a single Phase 1 connection. Grey parts are encrypted, either with IKE derived keys (light grey) or with IPsec keys (dark grey). The numbers at the curly brackets denote the number of messages to be exchanged in the protocol.

Where's the bug?

The public key encryption (PKE) based authentication mode of IKE requires that both parties exchanged their public keys securely beforehand (e. g. with certificates during an earlier handshake with signature based authentication). RFC 2409 advertises this mode of authentication with a plausibly deniable exchange to raise the privacy level. In this mode, messages three and four of the handshake exchange encrypted nonces and identities. They are encrypted using the public key of the respective other party. The encoding format for the ciphertexts is PKCS #1 v1.5.

Bleichenbacher attacks are adaptive chosen ciphertext attacks against RSA-PKCS #1 v1.5. Though the attack has been known for two decades, it is a common pitfall for developers. The mandatory use of PKCS #1 v1.5 in the PKE authentication methods raised suspicion of whether implementations resist Bleichenbacher attacks.

PKE authentication is available and fully functional in Cisco's IOS operating system. In Clavister's cOS and ZyXEL's ZyWALL USG devices, PKE is not officially available. There is no documentation and no configuration option for it and it is therefore not fully functional. Nevertheless, these implementations processed messages using PKE authentication in our tests.

Huawei implements a revised mode of the PKE mode mentioned in the RFC that saves one private key operation per peer (we call it RPKE mode). It is available in certain Huawei devices including the Secospace USG2000 series.

We were able to confirm the existence of Bleichenbacher oracles in all these implementations. Here are the CVE entries and security advisories by the vendors (I will add links once they are available):
On an abstract level, these oracles work as follows: If we replace the ciphertext of the nonce in the third handshake message with a modified RSA ciphertext, the responder will either indicate an error (Cisco, Clavister, and ZyXEL) or silently abort (Huawei) if the ciphertext is not PKCS #1 v1.5 compliant. Otherwise, the responder continues with the fourth message (Cisco and Huawei) or return an error notification with a different message (Clavister and ZyXEL) if the ciphertext is in fact PKCS #1 v1.5 compliant. Each time we learn that the ciphertext was valid, we can advance the Bleichenbacher attack one more step.

A Bleichenbacher Attack Against PKE

If a Bleichenbacher oracle is discovered in a TLS implementation, then TLS-RSA is broken since one can compute the Premaster Secret and the TLS session keys without any time limit on the usage of the oracle. For IKEv1, the situation is more difficult: Even if there is a strong Bleichenbacher oracle in PKE and RPKE mode, our attack must succeed within the lifetime of the IKEv1 Phase 1 session, since a Diffie-Hellman key exchange during the handshake provides an additional layer of security that is not present in TLS-RSA. For example, for Cisco this time limit is currently fixed to 60 seconds for IKEv1 and 240 seconds for IKEv2.

To phrase it differently: In TLS-RSA, a Bleichenbacher oracle allows to perform an ex post attack to break the confidentiality of the TLS session later on, whereas in IKEv1 a Bleichenbacher oracle only can be used to perform an online attack to impersonate one of the two parties in real time.

Bleichenbacher attack against IKEv1 PKE based authentication.

The figure above depicts a direct attack on IKEv1 PKE:
  1. The attackers initiate an IKEv1 PKE based key exchange with Responder A and adhere to the protocol until receiving the fourth message. They extract the encrypted nonce from this message, and record the other public values of the handshake.
  2. The attackers keep the IKE handshake with Responder A alive as long as the responder allows. For Cisco and ZyXEL we know that handshakes are cancelled after 60 seconds, Clavister and Huawei do so after 30 seconds.
  3. The attackers initiate several parallel PKE based key exchanges to Responder B.
    • In each of these exchanges, they send and receive the first two messages according to the protocol specifications.
    • In the third message, they include a modified version of the encrypted nonce according to the the Bleichenbacher attack methodology.
    • They wait until they receive an answer or they can reliably determine that this message will not be sent (timeout or reception of a repeated second handshake message).
  4. After receiving enough answers from Responder B, the attackers can compute the plaintext of the nonce.
  5. The attackers now have all the information to complete the key derivation and the handshake. They thus can impersonate Responder B to Responder A.

Key Reuse

Maintaining individual keys and key pairs for each protocol version, mode, and authentication method of IKE is difficult to achieve in practice. It is oftentimes simply not supported by implementations. This is the case with the implementations by Clavister and ZyXEL, for example. Thus, it is common practice to have only one RSA key pair for the whole IKE protocol family. The actual security of the protocol family in this case crucially depends on its cross-ciphersuite and cross-version security. In fact, our Huawei test device reuses its RSA key pair even for SSH host identification, which further exposes this key pair.

A Cross-Protocol Version Attack with Digital Signature Based Authentication

Signature Forgery Using Bleichenbacher's Attack

It is well known that in the case of RSA, performing a decryption and creating a signature is mathematically the same operation. Bleichenbacher's original paper already mentioned that the attack could also be used to forge signatures over attacker-chosen data. In two papers that my colleagues at our chair have published, this has been exploited for attacks on XML-based Web Services, TLS 1.3, and Google's QUIC protocol. The ROBOT paper used this attack to forge a signature from Facebook's web servers as proof of exploitability.

IKEv2 With Digital Signatures

Digital signature based authentication is supported by both IKEv1 and IKEv2. We focus here on IKEv2 because on Cisco routers, an IKEv2 handshake may take up to four minutes. This more relaxed timer compared to IKEv1 makes it an interesting attack target.

I promised that this blogpost will only give a comprehensive summary, therefore I am skipping all the details about IKEv2 here. It is enough to know that the structure of IKEv2 is fundamentally different from IKEv1.

If you're familiar with IT-security, then you will believe me that if digital signatures are used for authentication, it is not particularly good if an attacker can get a signature over attacker chosen data. We managed to develop an attack that exploits an IKEv1 Bleichenbacher oracle at some peer A to get a signature that can be used to break the IKEv2 authentication at another peer B. This requires that peer A reuses its key pair for IKEv2 also for IKEv1. For the details, please read our paper [alternative link to the paper].

Evaluation and Results

For testing the attack, we used a Cisco ASR 1001-X router running IOS XE in version 03.16.02.S with IOS version 15.5(3)S2. Unfortunately, Cisco's implementation is not optimized for throughput. From our observations we assume that all cryptographic calculations for IKE are done by the device's CPU despite it having a hardware accelerator for cryptography. One can easily overload the device's CPU for several seconds with a standard PC bursting handshake messages, even with the default limit for concurrent handshakes. And even if the CPU load is kept below 100 %, we nevertheless observed packet loss.

For the decryption attack on Cisco's IKEv1 responder, we need to finish the Bleichenbacher attack in 60 seconds. If the public key of our ASR 1001-X router is 1024 bits long, we measured an average of 850 responses to Bleichenbacher requests per second. Therefore, an attack must succeed with at most 51,000 Bleichenbacher requests.

But another limit is the management of Security Associations (SAs). There is a global limit of 900 Phase 1 SAs under negotiation per Cisco device in the default configuration. If this number is exceeded, one is blocked. Thus, one cannot start individual handshakes for each Bleichenbacher request to issue. Instead, SAs have to be reused as long as their error counter allows. Furthermore, establishing SAs with Cisco IOS is really slow. During the attack, the negotiations in the first two messages of IKEv1 require more time than the actual Bleichenbacher attack.

We managed to perform a successful decryption attack against our ASR 1001-X router with approximately 19,000 Bleichenbacher requests. However, due to the necessary SA negotiations, the attack took 13 minutes.

For the statistics and for the attack evaluation of digital signature forgery, we used a simulator with an oracle that behaves exactly as the ones by Cisco, Clavister, and ZyXEL. We found that about 26% of attacks against IKEv1 could be successful based on the cryptographic performance of our Cisco device. For digital signature forgery, about 22% of attacks could be successful under the same assumptions.

Note that (without a patched IOS), only non-cryptographic performance issues prevented a succesful attack on our Cisco device. There might be faster devices that do not suffer from this. Also note that a too slow Bleichenbacher attack does not permanently lock out attackers. If a timeout occurs, they can just start over with a new attack using fresh values hoping to require fewer requests. If the victim has deployed multiple responders sharing one key pair (e. g. for load balancing), this could also be leveraged to speed up an attack.

Responsible Disclosure

We reported our findings to Cisco, Huawei, Clavister, and ZyXEL. Cisco published fixes with IOS XE versions 16.3.6, 16.6.3, and 16.7.1. They further informed us that the PKE mode will be removed with the next major release.

Huawei published firmware version V300R001C10SPH702 for the Secospace USG2000 series that removes the Bleichenbacher oracle and the crash bugs we identified. Customers who use other affected Huawei devices will be contacted directly by their support team as part of a need-to-know strategy.

Clavister removed the vulnerable authentication method with cOS version 12.00.09. ZyXEL responded that our ZyWALL USG 100 test device is from a legacy model series that is end-of-support. Therefore, these devices will not receive a fix. For the successor models, the patched firmware version ZLD 4.32 (Release Notes) is available.

FAQs

  • Why don't you have a cool name for this attack?
    The attack itself already has a name, it's Bleichenbacher's attack. We just show how Bleichenbacher attacks can be applied to IKE and how they can break the protocol's security. So, if you like, call it IPsec-Bleichenbacher or IKE-Bleichenbacher.
  • Do you have a logo for the attack?
    No.
  • My machine was running a vulnerable firmware. Have I been attacked?
    We have no indication that the attack was ever used in the wild. However, if you are still concerned, check your logs. The attack is not silent. If your machine was used for a Bleichenbacher attack, there should be many log entries about decryption errors. If your machine was the one that got tricked (Responder A in our figures), then you could probably find log entries about unfinished handshake attempts.
  • Where can I learn more?
    First of all, you can read the paper [alternative link to the paper]. Second, you can watch the presentation, either live at the conference or later on this page.
  • What else does the paper contain?
    The paper contains a lot more details than this blogpost. It explains all authentication methods including IKEv2 and it gives message flow diagrams of the protocols. There, we describe a variant of the attack that uses the Bleichenbacher oracles to forge signatures to target IKEv2. Furthermore, we describe the quirks of Huawei's implementation including crash bugs that could allow for Denial-of-Service attacks. Last but not least, it describes a dictionary attack against the PSK mode of authentication that is covered in a separate blogpost.

Media Coverage, Blogs, and more

English

German

Related news
  1. Hackers Toolbox
  2. Hack Tools For Games
  3. Hack Tool Apk
  4. Pentest Tools Alternative
  5. Pentest Tools Alternative
  6. Hacking Apps
  7. Hack Tools Github
  8. Hacker Security Tools
  9. Hacker Tools 2020
  10. Hack Tools Mac
  11. Blackhat Hacker Tools
  12. Hacking Tools Software
  13. Hack Tools For Windows
  14. Hacking Tools Free Download
  15. Bluetooth Hacking Tools Kali
  16. Hack Apps
  17. Best Pentesting Tools 2018
  18. Pentest Tools Nmap
  19. How To Hack
  20. Pentest Tools Find Subdomains
  21. Beginner Hacker Tools
  22. Nsa Hacker Tools
  23. Hacking Apps
  24. Hacking Tools Free Download
  25. Install Pentest Tools Ubuntu
  26. Android Hack Tools Github
  27. World No 1 Hacker Software
  28. Pentest Tools For Android
  29. Pentest Tools For Ubuntu
  30. Hacking Tools
  31. Hacking Tools Online
  32. Hacking Tools 2020
  33. New Hack Tools
  34. Hacker Tools 2020
  35. Tools For Hacker
  36. Hacker Tools 2019
  37. How To Hack
  38. Tools 4 Hack
  39. Kik Hack Tools
  40. Bluetooth Hacking Tools Kali
  41. Hacking Tools Mac
  42. Hacker Tools Apk
  43. Nsa Hack Tools Download
  44. How To Hack
  45. Hack App
  46. Hacking Tools For Beginners
  47. Hacker Tools Hardware
  48. Hacking Tools For Windows Free Download
  49. Pentest Recon Tools
  50. Hacking Tools For Windows 7
  51. Hacking Tools Usb
  52. Growth Hacker Tools
  53. How To Hack
  54. Hacking Tools And Software
  55. Android Hack Tools Github
  56. Best Pentesting Tools 2018
  57. New Hack Tools
  58. Pentest Tools Online
  59. Pentest Tools Tcp Port Scanner
  60. Hacking Tools 2019
  61. Pentest Tools Android
  62. Hacker Hardware Tools
  63. Hacking Tools 2020
  64. Pentest Tools Bluekeep
  65. Hacking Tools For Pc
  66. Pentest Tools Apk
  67. Pentest Reporting Tools
  68. Tools For Hacker
  69. Hack Tools Online
  70. Hack Tools Mac
  71. Pentest Tools Github
  72. Pentest Tools Github
  73. Pentest Box Tools Download
  74. Ethical Hacker Tools
  75. Hacking Tools And Software
  76. Hacker Tools Windows
  77. Pentest Tools Android
  78. Hacker Security Tools
  79. Hack Tools Mac
  80. Top Pentest Tools
  81. Hacking Tools And Software
  82. Pentest Tools Linux
  83. Hack Tools For Mac
  84. Hacker Techniques Tools And Incident Handling
  85. Hacking Tools For Pc
  86. Hak5 Tools
  87. Hacking Tools
  88. Hacking Tools Free Download
  89. Pentest Tools Alternative
  90. Nsa Hacker Tools
  91. How To Hack
  92. Hack Tools For Pc
  93. Pentest Tools Review
  94. World No 1 Hacker Software
  95. Ethical Hacker Tools
  96. Nsa Hacker Tools
  97. Hacker Tools Github
  98. Black Hat Hacker Tools
  99. Hack Apps
  100. Hacker Security Tools
  101. Pentest Tools Framework
  102. Hacking Tools And Software
  103. Hacker Tools Apk Download
  104. New Hack Tools
  105. Hack Tools For Pc
  106. Hacker Tools Hardware
  107. Hacking Tools For Pc
  108. Hack And Tools
  109. Hacker Tools Online
  110. Hack Tools For Mac
  111. Pentest Tools Free
  112. Pentest Tools Website Vulnerability
  113. Hacker Tools For Ios
  114. Hack Rom Tools
  115. Hacker Tools Free Download
  116. Hacker Tools Free Download
  117. Pentest Tools Url Fuzzer
  118. Hacker Techniques Tools And Incident Handling
  119. Hacker Tools Mac
  120. Underground Hacker Sites
  121. Hacking Tools For Pc
  122. Pentest Box Tools Download
  123. Pentest Tools Review
  124. New Hack Tools
  125. Hacking Tools And Software
  126. How To Hack
  127. Hacker Tool Kit
  128. Pentest Reporting Tools
  129. Tools For Hacker
  130. Hacker Security Tools
  131. Pentest Tools Nmap
  132. Hacker Tools Online
  133. Hack Tool Apk No Root
  134. Beginner Hacker Tools
  135. Hacking Tools Mac
  136. Pentest Tools Linux
  137. Hacker Tools 2020
  138. Pentest Tools For Ubuntu
  139. Hack Tools For Games
  140. Black Hat Hacker Tools
  141. Hacking Tools For Games
  142. Pentest Tools Online
  143. Hacking Tools Name
  144. Hack Tools For Mac
  145. Bluetooth Hacking Tools Kali
  146. Game Hacking
  147. Hacker Tools Apk Download
  148. Pentest Tools Open Source
  149. Hack And Tools
  150. Hacking Tools For Mac
  151. Hacking Apps
  152. Hacker Security Tools
  153. Hacking Tools For Windows 7
  154. Pentest Tools Online
  155. Kik Hack Tools
  156. Best Hacking Tools 2020
  157. Hacking Tools Download
  158. Growth Hacker Tools
  159. Pentest Tools Subdomain

No comments:

Post a Comment