Introduction SHA-1 Cryptanalysis New chosen-prefjx collision techniques Conclusion From Collisions to Chosen-Prefjx Collisions Application to Full SHA-1 Gaëtan Leurent Thomas Peyrin Inria, France NTU, Singapour Eurocrypt 2019 Gaëtan Leurent, Thomas Peyrin From Collisions to Chosen-Prefjx Collisions Eurocrypt 2019 1 / 21
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin 2 / 21 H n Hash functions Conclusion New chosen-prefjx collision techniques ▶ Hash function: public function { 0 , 1 } ∗ → { 0 , 1 } n ▶ Maps arbitrary-length message to fixed-length hash ▶ Hash function should behave like a random function ▶ Hard to find collisions, preimages ▶ Hash can be used as fingerprint, identifier ▶ Used in many difgerent contexts ▶ Signature: hash-and-sign ▶ MAC: hash-and-PRF ▶ Blockchain: Proof-of-work, …
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin IV x 3 n x 2 m 2 n x 1 m 1 n x 0 m 0 n SHA-1 Conclusion New chosen-prefjx collision techniques 3 / 21 ▶ Designed by NSA: SHA-0 [1993], then SHA-1 [1995] ▶ Standardized by NIST, ISO, IETF, ... Widely used until quite recently ▶ State size: n = 160 ▶ Expected collision security 2 80 ▶ Iterative structure: Merkle-Damgård construction ▶ Block cipher-based compression function: Davies-Meyer H ( M )
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin IV x 3 n x 2 m 2 n x 1 m 1 n x 0 m 0 n SHA-1 Conclusion New chosen-prefjx collision techniques 3 / 21 ▶ Designed by NSA: SHA-0 [1993], then SHA-1 [1995] ▶ Standardized by NIST, ISO, IETF, ... Widely used until quite recently ▶ State size: n = 160 ▶ Expected collision security 2 80 ▶ Iterative structure: Merkle-Damgård construction ▶ Block cipher-based compression function: Davies-Meyer H ( M )
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin 9ae6a4c80cadccbb7f0a 38762cf7f55934b34d17 SHA-1 = SHAttered attack: Colliding PDFs [Stevens & al., Crypto’17] [Stevens, Karpman & Peyrin, Crypto’15] 2015-10 Practical freestart collision (on GPU) [Stevens, EC’13] [Wang & al., Crypto’05] SHA-1 Cryptanalysis Conclusion New chosen-prefjx collision techniques 4 / 21 2005-02 Theoretical collision with 2 69 operations … Several unpublished collision attacks in the range 2 51 — 2 63 2010-11 Theoretical collision with 2 61 operations 2017-02 Practical collision with 2 64 . 7 operations (on GPU)
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin SSL Certificate: [...] $ sslscan mail.sim.informatik.tu-darmstadt.de:993 5 / 21 Conclusion SHA-1 today New chosen-prefjx collision techniques ▶ Modern web browsers reject SHA-1 certificates since 2017 ▶ SHA-1 certificates still exists ▶ CAs still sell legacy SHA-1 certificates ▶ SHA-1 certificates still accepted by modern non-browser TLS clients ▶ Until a few week ago, a mailserver in TU Darmsdtat used a SHA-1 certificate ▶ Windows 10 “Mail” app connects without error Signature Algorithm: sha1WithRSAEncryption ▶ SHA-1 also used in Git, TLS 1.2 handshake, ...
Introduction SHA-1 Cryptanalysis Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin SSL Certificate: [...] $ sslscan mail.sim.informatik.tu-darmstadt.de:993 5 / 21 Conclusion SHA-1 today New chosen-prefjx collision techniques ▶ Modern web browsers reject SHA-1 certificates since 2017 ▶ SHA-1 certificates still exists ▶ CAs still sell legacy SHA-1 certificates ▶ SHA-1 certificates still accepted by modern non-browser TLS clients ▶ Until a few week ago, a mailserver in TU Darmsdtat used a SHA-1 certificate ▶ Windows 10 “Mail” app connects without error Signature Algorithm: sha1WithRSAEncryption ▶ SHA-1 also used in Git, TLS 1.2 handshake, ...
Introduction P Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin ” suffjx prefix SHA-1 Cryptanalysis S C 2 C 1 6 / 21 IV Adding prefjx and suffjx New chosen-prefjx collision techniques C 2 Conclusion Exploiting collisions Collision attack IV C 1 ▶ Start from IV ▶ Add identical prefix and suffjx using iterative structure ▶ C 1 and C 2 collide ▶ Usually same diffjculty (just a difgerent IV) ▶ Issue: C 1 and C 2 look random (not controlled) ▶ Solution: hide in some ignored sections of the file ( e.g. comment) ▶ Issue: collision is not meaningful ▶ Solution: many file formats ( e.g. PDF) allow conditional branches M 1 = “ if ( C 1 == C 1 ) { good } else { evil } ” M 2 = “ if ( C 2 == C 1 ) { good } else { evil }
Introduction P Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin ” suffjx prefix SHA-1 Cryptanalysis S C 2 C 1 6 / 21 IV Adding prefjx and suffjx New chosen-prefjx collision techniques C 2 Conclusion Exploiting collisions Collision attack IV C 1 ▶ Start from IV ▶ Add identical prefix and suffjx using iterative structure ▶ C 1 and C 2 collide ▶ Usually same diffjculty (just a difgerent IV) ▶ Issue: C 1 and C 2 look random (not controlled) ▶ Solution: hide in some ignored sections of the file ( e.g. comment) ▶ Issue: collision is not meaningful ▶ Solution: many file formats ( e.g. PDF) allow conditional branches M 1 = “ if ( C 1 == C 1 ) { good } else { evil } ” M 2 = “ if ( C 2 == C 1 ) { good } else { evil }
Introduction Chosen-prefjx collision Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin [Bhargavan & L, NDSS’16] [Stevens & al, Crypto’09] S 2 C 2 1 C 1 P 2 P 1 IV SHA-1 Cryptanalysis 7 / 21 Identical-prefjx collision random collision blocks New chosen-prefjx collision techniques Conclusion S C 2 C 1 P Chosen-Prefjx Collisions IV [Stevens, Lenstra & de Weger, EC’07] ▶ Even with a prefix and prefix, many protocol seem unafgected by collision attacks ▶ Given IV, find M 1 ≠ M 2 s. t. ▶ Given P 1 , P 2 , find M 1 ≠ M 2 s. t. H ( M 1 ) = H ( M 2 ) H ( P 1 ‖ M 1 ) = H ( P 2 ‖ M 2 ) C ′ C ′ ▶ Arbitrary common prefix/suffjx, ▶ Breaks certificates ▶ Breaks integrity verification ▶ Breaks TLS, IKE, SSH ▶ Breaks signatures (in theory)
Introduction Chosen-prefjx collision Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin [Bhargavan & L, NDSS’16] [Stevens & al, Crypto’09] S 2 C 2 1 C 1 P 2 P 1 IV SHA-1 Cryptanalysis 7 / 21 Identical-prefjx collision random collision blocks New chosen-prefjx collision techniques Conclusion S C 2 C 1 P Chosen-Prefjx Collisions IV [Stevens, Lenstra & de Weger, EC’07] ▶ Even with a prefix and prefix, many protocol seem unafgected by collision attacks ▶ Given IV, find M 1 ≠ M 2 s. t. ▶ Given P 1 , P 2 , find M 1 ≠ M 2 s. t. H ( M 1 ) = H ( M 2 ) H ( P 1 ‖ M 1 ) = H ( P 2 ‖ M 2 ) C ′ C ′ ▶ Arbitrary common prefix/suffjx, ▶ Breaks certificates ▶ Breaks integrity verification ▶ Breaks TLS, IKE, SSH ▶ Breaks signatures (in theory)
Introduction koT02UA3eW6q Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin 3 Bob copies the signature to k A , impersonates Alice 2 Bob asks CA to certify his key k B Impersonation attack SHA-1 Cryptanalysis PKI Infrastructure IWFEWrrnxkK8 q5q9Hq09Tp5R The public [Stevens, Lenstra & de Weger, EC’07] Attacking key certifjcation Conclusion New chosen-prefjx collision techniques 8 / 21 key of Alice is: 1 Bob creates keys s.t. H ( Alice || k A ) = H ( Bob || k B ) ▶ Alice generates key ▶ Ask PKI to sign ▶ Certificate proves ID
Introduction koT02UA3eW6q Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin 3 Bob copies the signature to k A , impersonates Alice 2 Bob asks CA to certify his key k B Impersonation attack SHA-1 Cryptanalysis PKI Infrastructure IWFEWrrnxkK8 q5q9Hq09Tp5R The public [Stevens, Lenstra & de Weger, EC’07] Attacking key certifjcation Conclusion New chosen-prefjx collision techniques 8 / 21 key of Alice is: 1 Bob creates keys s.t. H ( Alice || k A ) = H ( Bob || k B ) ▶ Alice generates key ▶ Ask PKI to sign ▶ Certificate proves ID
Introduction YRfYal4ZFmiY Eurocrypt 2019 From Collisions to Chosen-Prefjx Collisions Gaëtan Leurent, Thomas Peyrin 3 Bob copies the signature to k A , impersonates Alice 2 Bob asks CA to certify his key k B Impersonation attack PKI Infrastructure collision prefix SHA-1 Cryptanalysis E7OhkirqNyfm 7+zvZNcjdxXx The public New chosen-prefjx collision techniques Conclusion Attacking key certifjcation [Stevens, Lenstra & de Weger, EC’07] 8 / 21 seJ+L6NRaT49 ZOt226BvLIO5 OE6p9TY2sW74 The public key of Alice is: key of Bob is: 1 Bob creates keys s.t. H ( Alice || k A ) = H ( Bob || k B ) ▶ Alice generates key ▶ Ask PKI to sign ▶ Certificate proves ID
Recommend
More recommend
