dual ec
play

Dual EC a standardized back door Ruben Niederhagen Joint work with - PowerPoint PPT Presentation

Jan 03, 2023 •338 likes •1.97k views

Dual EC a standardized back door Ruben Niederhagen Joint work with Stephen Checkoway 1 , Matthew Fredrikson 2 , Matthew Green 1 , Tanja Lange 3 , Thomas Ristenpart 2 , Daniel J. Bernstein 3,5 Jake Maskiewicz 4 , and Hovav Shacham 4 , . Related

  1. Authors of Dual EC 8/31 Kelsey, in December 2013 slides: § Standardization effort by “NIST and NSA, with some participation from CSE”. § “Most of work on standards done by US federal employees (NIST and NSA, with some help from CSE)” § The standard Dual EC parameters P and Q come “ultimately from designers of Dual EC DRBG at NSA”. Ruben Niederhagen: Dual EC — a standardized back door

  2. Attack Target — TLS 9/31 Transport Layer Security (TLS) § Used in the Internet for encryption of communication. Examples: § eMail transport, § online banking, § online shopping, § . . . § Standard covers a fast amount of protocols and optional features. § Client and server agree on what parameters to use. § Client and server agree on a random secret key. Ruben Niederhagen: Dual EC — a standardized back door

  3. TLS Handshake 10/31 Client Server generate client random c l i e n t r a generate n d o m session ID, g , s i P k ) , a t ( p c e r I D , server random, a , o n e s s i m , s d o r a n v e r s e r signature nonce generate b bP , Finished Finished Ruben Niederhagen: Dual EC — a standardized back door

  4. Attack Target — TLS 11/31 Common TLS implementations: § RSA’s BSAFE § RSA BSAFE Share for Java (BSAFE Java) § RSA BSAFE Share for C and C++ (BSAFE C) § Microsoft’s SChannel § OpenSSL All of these offer Dual EC. Ruben Niederhagen: Dual EC — a standardized back door

  5. Attack Target — TLS 11/31 Common TLS implementations: § RSA’s BSAFE § RSA BSAFE Share for Java (BSAFE Java) § RSA BSAFE Share for C and C++ (BSAFE C) § Microsoft’s SChannel Remember: NSA paid RSA Security $10 million § OpenSSL to use Dual EC as the default RNG! All of these offer Dual EC. Ruben Niederhagen: Dual EC — a standardized back door

  6. Elliptic Curve Discrete Logarithm Problem 12/31 Arithmetic on Elliptic Curves Operate on points P “ p x P , y P q on an elliptic curve: § addition: A ` B “ C , § scalar mul.: k ¨ A “ A ` A ` ¨ ¨ ¨ ` A . loooooooomoooooooon k ´ times Ruben Niederhagen: Dual EC — a standardized back door

  7. Elliptic Curve Discrete Logarithm Problem 12/31 Arithmetic on Elliptic Curves Operate on points P “ p x P , y P q on an elliptic curve: § addition: A ` B “ C , § scalar mul.: k ¨ A “ A ` A ` ¨ ¨ ¨ ` A . loooooooomoooooooon k ´ times Useful in Cryptography: It is easy to compute k ¨ A , e.g.: B “ 243 ¨ A “ A ` 2 A ` 16 A ` 32 A ` 64 A ` 128 A . Cost: 5 additions and 7 doublings. Ruben Niederhagen: Dual EC — a standardized back door

  8. Elliptic Curve Discrete Logarithm Problem 12/31 Arithmetic on Elliptic Curves Operate on points P “ p x P , y P q on an elliptic curve: § addition: A ` B “ C , § scalar mul.: k ¨ A “ A ` A ` ¨ ¨ ¨ ` A . loooooooomoooooooon k ´ times Useful in Cryptography: It is easy to compute k ¨ A , e.g.: B “ 243 ¨ A “ A ` 2 A ` 16 A ` 32 A ` 64 A ` 128 A . Cost: 5 additions and 7 doublings. For given A and B , it is hard to find k such that B “ k ¨ A ! Ruben Niederhagen: Dual EC — a standardized back door

  9. Dual EC 13/31 Parameters Here: elliptic curve over finite filed with NIST prime P-256. (NIST SP800-90A also defines curves for P-384 and P-521.) The elliptic curve is defined over F p with p “ 2 256 ´ 2 224 ` 2 192 ` 2 96 ´ 1. The curve is given in short Weierstrass form E : y 2 “ x 3 ´ 3 x ` b , where b “ 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b . Dual EC defines two points, a base point P and a second point Q : P x “ 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 , P y “ 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5 ; Q x “ 0xc97445f45cdef9f0d3e05e1e585fc297235b82b5be8ff3efca67c59852018192 , Q y “ 0xb28ef557ba31dfcbdd21ac46e2a91e3c304f44cb87058ada2cb815151e610046 . Ruben Niederhagen: Dual EC — a standardized back door

  10. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 0 Ruben Niederhagen: Dual EC — a standardized back door

  11. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 0 s 1 Ruben Niederhagen: Dual EC — a standardized back door

  12. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 0 s 1 r 1 “ x p s 1 Q q r 1 Ruben Niederhagen: Dual EC — a standardized back door

  13. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 0 s 1 r 1 “ x p s 1 Q q r 1 r 1 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  14. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 0 s 1 s 2 r 1 “ x p s 1 Q q r 1 r 1 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  15. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 0 s 1 s 2 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 1 r 1 r 2 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  16. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 1 r 1 r 2 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  17. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 2 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  18. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  19. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  20. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q ? r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  21. Dual EC — Basic Procedure 14/31 Points Q and P on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 ECDLP! r 1 “ x p s 1 Q q ? r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  22. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  23. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q x p d ¨ s 1 Q q r 1 r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  24. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. s 2 “ x p s 1 P q “ x p s 1 ¨ dQ q 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q x p d ¨ s 1 Q q r 1 r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  25. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r c r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  26. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q R c “ p r c , y p r c qq r 1 r 1 r c r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  27. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s c s 2 s 3 x p dR c q r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q R c “ p r c , y p r c qq r 1 r c r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  28. Shumow and Ferguson – the Basic Attack 14/31 Points Q and P “ dQ on an elliptic curve. 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s c s 2 s 3 x p dR c q r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q R c “ p r c , y p r c qq r 1 r c r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  29. Shumow and Ferguson – the Basic Attack 14/31 32 bytes s 1 “ x p s 0 P q s 2 “ x p s 1 P q s 3 “ x p s 2 P q s 4 “ x p s 3 P q s 0 s 1 s 2 s 3 r 1 “ x p s 1 Q q r 2 “ x p s 2 Q q r 3 “ x p s 3 Q q r 1 r 1 r 2 r 2 r 3 r 3 30 bytes Ruben Niederhagen: Dual EC — a standardized back door

  30. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q s 0 s 1 s 2 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  31. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q s 0 s 1 s 2 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  32. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q s 0 s 1 s 2 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r c r 1 r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  33. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q ? s 0 s 1 s 2 s 3 x p dR c q x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  34. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q ? s 0 s 1 s 2 s 3 x p dR c q x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  35. Dual EC — NIST SP800-90 in June 2006 15/31 t 1 t 2 ‚ ‘ H p adin 1 q x p‚ P q ‚ ‘ H p adin 2 q x p‚ P q ‚ ‘ H p adin 4 q x p‚ P q s 0 s 1 s 2 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r 2 r 2 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  36. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p‚ P q x p‚ P q s 0 s 1 s 3 s 2 s 4 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r 2 r 2 r 3 r 3 r 4 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  37. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p‚ P q x p‚ P q s 0 s 1 s 3 s 2 s 4 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r 2 r 2 r 3 r 3 r 4 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  38. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p‚ P q x p‚ P q s 0 s 1 s 3 s 2 s 4 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 1 r c r 2 r 3 r 2 r 4 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  39. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s c s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p dR c q x p‚ P q x p‚ P q s 0 s 1 s 3 s 2 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 1 r 3 r 2 r 2 r 4 r 3 r 3 Ruben Niederhagen: Dual EC — a standardized back door

  40. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s c s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p dR c q x p‚ P q x p‚ P q s 0 s 1 s 2 s 3 s 4 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r c r 1 r 1 r 2 r 3 r 2 r 3 r 3 r 4 Ruben Niederhagen: Dual EC — a standardized back door

  41. Dual EC — NIST SP800-90 in March 2007 16/31 s 0 s c s 2 s 5 ‚ ‘ H p adin 1 q ‚ ‘ H p adin 3 q ‚ ‘ H p adin 6 q x p‚ P q x p‚ P q t 1 t 3 t 2 x p dR c q x p‚ P q x p‚ P q s 0 s 1 s 2 s 3 s 4 s 3 x p‚ Q q x p‚ Q q x p‚ Q q r c r 1 r 1 r 2 r 3 r 2 r 3 r 3 r 4 Ruben Niederhagen: Dual EC — a standardized back door

  42. Attack 17/31 Attack targets in our analysis: In the real world, the attack is more complicated. We attacked: § RSA’s BSAFE § RSA BSAFE Share for Java (BSAFE Java) § RSA BSAFE Share for C and C++ (BSAFE C) § Microsoft’s SChannel § OpenSSL We replaced the points P and Q with known P “ dQ ; this required some reverse engineering of BSAFE and SChannel. Ruben Niederhagen: Dual EC — a standardized back door

  43. Attack 17/31 Attack targets in our analysis: In the real world, the attack is more complicated. We attacked: § RSA’s BSAFE § RSA BSAFE Share for Java (BSAFE Java) § RSA BSAFE Share for C and C++ (BSAFE C) § Microsoft’s SChannel § OpenSSL-fixed We replaced the points P and Q with known P “ dQ ; this required some reverse engineering of BSAFE and SChannel. Ruben Niederhagen: Dual EC — a standardized back door

  44. Attack — Example: BSAFE-Java 18/31 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  45. Attack — Example: BSAFE-Java 18/31 s 0 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  46. Attack — Example: BSAFE-Java 18/31 s 0 x p‚ P q s 1 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  47. Attack — Example: BSAFE-Java 18/31 s 0 x p‚ P q s 1 x p‚ Q q r 1 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  48. Attack — Example: BSAFE-Java 18/31 s 0 x p‚ P q s 1 x p‚ Q q r 1 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  49. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q s 1 x p‚ Q q r 1 server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  50. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q s 1 x p‚ Q q r 1 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  51. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q s 1 s 3 x p‚ Q q r 1 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  52. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q s 1 s 3 x p‚ Q q x p‚ Q q r 1 r 3 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  53. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q s 1 s 3 x p‚ Q q x p‚ Q q r 1 r 3 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  54. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q r 1 r 3 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  55. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  56. Attack — Example: BSAFE-Java 18/31 s 0 s 2 x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  57. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  58. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce Ruben Niederhagen: Dual EC — a standardized back door

  59. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ‚ P ECDHE public key Ruben Niederhagen: Dual EC — a standardized back door

  60. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  61. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  62. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  63. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s c s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  64. Attack — Example: BSAFE-Java 18/31 s 0 s c s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ? ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  65. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s c s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature Ruben Niederhagen: Dual EC — a standardized back door

  66. Attack — Example: BSAFE-Java 18/31 s 0 s c s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r 1 r c r 3 r 4 server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ‚ P ‚ P ECDHE public key ECDSA signature average cost: 2 31 p C v ` 5 C f q Ruben Niederhagen: Dual EC — a standardized back door

  67. Attack — Example: BSAFE-Java 18/31 s 0 s c s 2 s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r c r 1 r 3 r 4 Exposes longterm secret key! server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ECDSA nonce ‚ P ‚ P Impersonation attack possible! ECDHE public key ECDSA signature average cost: 2 31 p C v ` 5 C f q Ruben Niederhagen: Dual EC — a standardized back door

  68. Attack — Example: BSAFE-Java 18/31 s 0 s 2 s c s 5 x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p‚ P q x p dR q s 1 s 3 s 4 x p‚ Q q x p‚ Q q x p‚ Q q r c r 1 r 3 r 4 Exposes longterm secret key! server random server random ECDHE priv. key ECDHE priv. key ECDSA nonce ECDSA nonce ECDSA nonce ECDSA nonce ‚ P ‚ P Impersonation attack possible! ECDHE public key ECDSA signature average cost: 2 31 p C v ` 5 C f q Ruben Niederhagen: Dual EC — a standardized back door

  69. Attack — BSAFE-C 19/31 session ID server random DHE key Ruben Niederhagen: Dual EC — a standardized back door

  70. Attack — BSAFE-C 19/31 s 0 session ID server random DHE key Ruben Niederhagen: Dual EC — a standardized back door

  71. Attack — BSAFE-C 19/31 s 0 x p‚ P q s 1 session ID server random DHE key Ruben Niederhagen: Dual EC — a standardized back door

  72. Attack — BSAFE-C 19/31 s 0 x p‚ P q s 1 x p‚ Q q r 1 session ID server random DHE key Ruben Niederhagen: Dual EC — a standardized back door

  73. Attack — BSAFE-C 19/31 s 0 x p‚ P q s 1 x p‚ Q q r 1 session ID server random DHE key Ruben Niederhagen: Dual EC — a standardized back door

Recommend

Dual Credit Courses What does it mean to be a dual credit student? Dual enrollment simply means: A

Dual Credit Courses What does it mean to be a dual credit student? Dual enrollment simply means: A

Lamar Consolidated ISD & Lone Star College Present Dual Credit Courses What does it mean to be a dual credit student? Dual enrollment simply means: A student is still in high school and enrolled in a college-level class at the same time;

371 views • 16 slides
DUAL CREDIT WHAT IS DUAL CREDIT? Dual credit means two things are happening at once. Students

DUAL CREDIT WHAT IS DUAL CREDIT? Dual credit means two things are happening at once. Students

DUAL CREDIT WHAT IS DUAL CREDIT? Dual credit means two things are happening at once. Students are earning high school credit while also earning college credit. Dual credit courses are taught at the college level. Expect the class to be

323 views • 21 slides
Dual Universities and the Dual System is there a new shift towards academic pathways in

Dual Universities and the Dual System is there a new shift towards academic pathways in

Presentation at the Ontario Institute for Studies of Education, Toronto 13.9.18 Prof. Dr. Dr. h.c. Thomas Deissinger, University of Konstanz, Chair of Business Education Dual Universities and the Dual System is there a new shift towards

336 views • 30 slides
Dual Deploy Recovery Why do dual deploy? What you need Mandatory

Dual Deploy Recovery Why do dual deploy? What you need Mandatory

Dual Deploy Recovery Why do dual deploy? What you need Mandatory Optional/Configuration-dependent Altimeter Redundant systems Wiring Charge wells Battery and holder Shear pins Switch Parachute management

599 views • 37 slides
Lenguaje dual en el distrito 47 Dual Language in District 47 2017-2018 What is Dual Language?

Lenguaje dual en el distrito 47 Dual Language in District 47 2017-2018 What is Dual Language?

Lenguaje dual en el distrito 47 Dual Language in District 47 2017-2018 What is Dual Language? Dual Language programs integrate native English speaking students with native Spanish speaking students to receive academic instruction in both

549 views • 18 slides
What to to do, when en to to do it, t, where ere to to find nd it t and how to to get t

What to to do, when en to to do it, t, where ere to to find nd it t and how to to get t

* THE FOLLOWING INFORMATION APPLIES ONLY TO PUSD STUDENTS THAT ARE CURRENTLY ENROLLED IN A HIGH SCHOOL DUAL ENROLLMENT COURSE THAT HAS BEEN APPROVED BY THE COLLEGE FOR DUAL ENROLLMENT CREDIT, AND THAT IS BEING TAUGHT BY A TEACHER WHO IS DUAL

266 views • 25 slides
We Welco lcome me To To Du Dual al En Enro rollment llment Dual Enrollment provides high

We Welco lcome me To To Du Dual al En Enro rollment llment Dual Enrollment provides high

We Welco lcome me To To Du Dual al En Enro rollment llment Dual Enrollment provides high school students opportunities to find their passion, earn college credit, gain college experience and reduce the need for remedial courses. Dual

466 views • 33 slides
13.1 Review of Last Lecture Review of primal and dual of SVM. Insights: Dual only depends on

13.1 Review of Last Lecture Review of primal and dual of SVM. Insights: Dual only depends on

CS/CNS/EE 253: Advanced Topics in Machine Learning Topic: Reproducing Kernel Hilbert Spaces Lecturer: Andreas Krause Scribe: Thomas Desautels Date: 2/22/20 13.1 Review of Last Lecture Review of primal and dual of SVM. Insights: Dual only

233 views • 5 slides
Dual Enrollment 2020-21 presentation by Lori Morrell What is Dual Enrollment? Dual

Dual Enrollment 2020-21 presentation by Lori Morrell What is Dual Enrollment? Dual

Dual Enrollment 2020-21 presentation by Lori Morrell What is Dual Enrollment? Dual Enrollment (DE) takes place when a high school student is enrolled in high school and college simultaneously. In other words, the student is approved for

421 views • 16 slides
Dual-Enrollment Lakewood Ranch High School What is Dual-Enrollment? The dual enrollment

Dual-Enrollment Lakewood Ranch High School What is Dual-Enrollment? The dual enrollment

Dual-Enrollment Lakewood Ranch High School What is Dual-Enrollment? The dual enrollment program is the enrollment of an eligible secondary student or home education student in a postsecondary course creditable toward high school completion

350 views • 20 slides
Calhoun Community College Dual Enrollment Info Session for Students & Parents What is Dual

Calhoun Community College Dual Enrollment Info Session for Students & Parents What is Dual

Calhoun Community College Dual Enrollment Info Session for Students & Parents What is Dual Enrollment & Dual Credit? Dual Enrollment/Dual Credit is a program which allows eligible high school students to enroll in college classes

196 views • 15 slides
Dual Credit Spring 2016 Info Session Welcome Parents & Students! WHAT is Dual Credit?

Dual Credit Spring 2016 Info Session Welcome Parents & Students! WHAT is Dual Credit?

Dual Credit Spring 2016 Info Session Welcome Parents & Students! WHAT is Dual Credit? ACCs Dual Credit program allows eligible high school students residing in the ACC service area to enroll in college level classes with tuition

172 views • 13 slides
MassHealth Demonstration to Integrate Care for Dual Eligibles 2010 Profile of Dual Eligibles

MassHealth Demonstration to Integrate Care for Dual Eligibles 2010 Profile of Dual Eligibles

MassHealth Demonstration to Integrate Care for Dual Eligibles 2010 Profile of Dual Eligibles Open Public Meeting April 9, 2012 10 am 12 pm State Transportation Building, Boston CY2010 PROFILE DUAL ELIGIBLES 21-64 YEARS OLD Population

812 views • 32 slides
Who Are the Dual Eligibles Dual eligibles are Medicare beneficiaries who are also

Who Are the Dual Eligibles Dual eligibles are Medicare beneficiaries who are also

Figure 1 Who Are the Dual Eligibles Dual eligibles are Medicare beneficiaries who are also enrolled in Medicaid Full dual eligibles Medicare serves as primary payor of their health care Medicaid serves as

471 views • 7 slides
OFF CAMPUS DUAL ENROLLMENT N H H S D E P R E S E N TAT I O N F E B R U A RY 2 5 , 2 0 2 0

OFF CAMPUS DUAL ENROLLMENT N H H S D E P R E S E N TAT I O N F E B R U A RY 2 5 , 2 0 2 0

OFF CAMPUS DUAL ENROLLMENT N H H S D E P R E S E N TAT I O N F E B R U A RY 2 5 , 2 0 2 0 DUAL ENROLLMENT- THE BASICS Dual Enrolled students are enrolled in high school and college at the same time. Students receive credit on both the

421 views • 10 slides
Dual Credit Welcome Students & Parents WHAT is Dual Credit? ACC HS Program that allows

Dual Credit Welcome Students & Parents WHAT is Dual Credit? ACC HS Program that allows

Dual Credit Welcome Students & Parents WHAT is Dual Credit? ACC HS Program that allows eligible high school students residing in the ACC service area to enroll in college level classes. . Cost/Waiver Structure : Students receive a

325 views • 14 slides
Dual Credit Program Welcome! We are excited to have you participate in FBISD/HCCs Dual Credit

Dual Credit Program Welcome! We are excited to have you participate in FBISD/HCCs Dual Credit

FBISD / HCC Dual Credit Program Welcome! We are excited to have you participate in FBISD/HCCs Dual Credit Program! Dual Credit Overview What it is, types of dual credit, benefits. Student Requirements Who is eligible and how?

658 views • 39 slides
AP AP/Dual /Dual Cre Credit dit & Aca cade demic mic Spe peci cialty alty Sh

AP AP/Dual /Dual Cre Credit dit & Aca cade demic mic Spe peci cialty alty Sh

AP AP/Dual /Dual Cre Credit dit & Aca cade demic mic Spe peci cialty alty Sh Showcase owcase Ham amilt ilton on Sou outh theast eastern ern Hig igh h Sch choo ool What Is Our Purpose Tonight? To provide you with

979 views • 25 slides
Dual Credit Temple College Please pick up a Dual Credit and/or REACH Packet. DO NOT fill

Dual Credit Temple College Please pick up a Dual Credit and/or REACH Packet. DO NOT fill

Dual Credit Temple College Please pick up a Dual Credit and/or REACH Packet. DO NOT fill anything out at this time. What is Dual Credit? Dual Credit is a way for high school students to earn college credit while also fulfilling their needs

592 views • 24 slides
Washington State K-12 Dual Language Initiative Patty Finnegan, PhD Members of the OSPI K-12 Dual

Washington State K-12 Dual Language Initiative Patty Finnegan, PhD Members of the OSPI K-12 Dual

Washington State K-12 Dual Language Initiative Patty Finnegan, PhD Members of the OSPI K-12 Dual Language Steering Committee Heritage Language Symposium / February 22, 2020 1 WA State Supt. Reykdals Vision for K -12 Education Includes Dual

479 views • 13 slides
Nursing Dual Enrollment Pathway Program Christine Amoresano Gallager, MSW Dual Enrollment

Nursing Dual Enrollment Pathway Program Christine Amoresano Gallager, MSW Dual Enrollment

Nursing Dual Enrollment Pathway Program Christine Amoresano Gallager, MSW Dual Enrollment Coordinator, MSU Denver Nursing Department What is Dual Enrollment? Bridge an Associates to a Bachelors Complete BSN requirements alongside

279 views • 8 slides
Du Dual al Enr nrollment ollment I WANT MY STUDENT TO PARTICIPATE IN DUAL ENROLLMENT, BUT

Du Dual al Enr nrollment ollment I WANT MY STUDENT TO PARTICIPATE IN DUAL ENROLLMENT, BUT

TALLAHASSEE COMMUNITY COLLEGE Parent Information Du Dual al Enr nrollment ollment I WANT MY STUDENT TO PARTICIPATE IN DUAL ENROLLMENT, BUT I dont know where to start, or I found information but I am left with more questions

621 views • 40 slides
Dual Interface Technology Update EuroForum 2014 Munich Agenda 1/ Dual Interface Technologies

Dual Interface Technology Update EuroForum 2014 Munich Agenda 1/ Dual Interface Technologies

Dual Interface Technology Update EuroForum 2014 Munich Agenda 1/ Dual Interface Technologies 2/ Cards Market: Dual Interface Banking 3/ Conclusions Agenda 1/ Dual Interface Technologies SOME HISTORICAL FACTS First developments of

449 views • 26 slides
Update Upd te o on the n the dual dual phase phase light ght simulati si ation i on in l

Update Upd te o on the n the dual dual phase phase light ght simulati si ation i on in l

Update Upd te o on the n the dual dual phase phase light ght simulati si ation i on in l n larsoft arsoft J. Soto - 1 / 12 - 12 - | 09 09/10 10/18 Some activities ongoing Towards the TDR: Working on generating a sample

392 views • 12 slides

More recommend