On the Security of RC4 in TLS Nadhem AlFardan, Dan Bernstein, Kenny - PowerPoint PPT Presentation

On the Security of RC4 in TLS Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering, Jacob Schuldt Royal Holloway, University of London University of Illinois at Chicago http://www.isg.rhul.ac.uk/tls/

Agenda • Brief overview of TLS and use of RC4 • Analysis of RC4 • Two attacks against RC4 in TLS • Single-byte attack • Double-byte attack • Conclusions 2

TLS • TLS = Transport Layer Security • Security goal: provide confidential and authenticated channel between client and server Client Server TLS Application data • Applications of TLS are ubiqutous • Secure websites (https://), secure e-mail (IMAP/TLS, POP/TLS, SMPT/TLS), mobile application, etc. 3

Brief History of TLS • Started life as Secure Socket Layer (SSL) protocol • Developed at Netscape ~1994 • SSL v3 (1996) still widely supported • TLS = IETF standardization of SSL • TLS v1.0 in RFC 2246 (1999) • Based on SSL v3 but not compatible • TLS v1.1 in RFC 4346 (2006) • TLS v1.2 in RFC 5246 (2008) 4

Simplified View of TLS Used by client and server to 1. Negotiate ciphersuite 2. Authenticate 3. Establish keys used in the Record Protocol Client Server Handshake Protocol Record Protocol Provides confidentiality and authenticity of application layer data using keys from Handshake Protocol 5

TLS Record Protocol: MAC-Encode-Encrypt SQN || HDR Payload MAC Payload MAC tag Padding Encrypt HDR Ciphertext HMAC-MD5, HMAC-SHA1, HMAC-SHA256 MAC CBC-AES128, CBC-AES256, CBC-3DES, RC4-128 Encrypt 6

TLS Record Protocol: RC4-128 SQN || HDR Payload MAC Payload MAC tag ⊕ RC4 Keystream HDR Ciphertext 7

TLS Record Protocol: RC4-128 SQN || HDR Payload RC4 State Byte permutation and indices i and j S MAC RC4 Keystream generation RC4 Key scheduling begin begin i ← i + 1 mod 256 for i = 0 to 255 do Payload MAC tag j ← j + S [ i ] mod 256 S [ i ] ← i swap( S [ i ], S [ j ]) end ⊕ Z ← S [ S [ i ] + S [ j ] mod 256 ] j ← 0 RC4 Keystream return Z for i = 0 to 255 do end j ← j + S [ i ] + K [ i mod keylen ] mod 256 swap( S [ i ], S [ j ]) end i , j ← 0 HDR Ciphertext end 8

TLS Record Protocol: Authenticated Encryption • TLS 1.2 additionally supports authenticated encryption • AES-GCM in RFC 5288 • AES-CCM in RFC 6655 • However, TLS 1.2 is not widely supported SSL Pulse: Webserver TLS support Browser TLS support (out-of-the-box) TLS v1.1 TLS v1.1 TLS v1.0 TLS v1.0 TLS v1.0 9

Use of RC4 in TLS • Recent attacks on CBC-based ciphersuites in TLS: • BEAST attack, Lucky 13 • In face of these, switching to RC4 has been a recommended mitigation approach (e.g. Qualys, F5) • Use of RC4 in the wild: ICSI Certificate Notary Recent survey of 16 billion TLS connections: Approx. 50% protected via RC4 ciphersuites • Problem: RC4 is known to have statistical weaknesses 10

Single-byte Biases in the RC4 Keystream Z i = value of i - th keystream byte • [Mantin-Shamir 2001]: 1 Pr[ Z 2 = 0] ≈ 128 • [Mironov 2002]: • Described distribution of (bias away from 0, sine-like distribution) Z 1 • [Maitra-Paul-Sen Gupta 2011]: for 3 ≤ r ≤ 255 1 Pr[ Z r = 0] = 256 + 0.242811 ≤ c r ≤ 1.337057 c r 256 2 • [Sen Gupta-Maitra-Paul-Sakar 2011]: 1 1 l = keylength Pr[ Z l = 256 − l ] ≥ 256 + 256 2 11

Complete Keystream Byte Distributions • Our approach • Based on the output from 2 44 random independent 128 bit RC4 keys, estimate the keystream byte distribution of the first 256 bytes Ciphertext distribution at position 1 Ciphertext distribution at position 2 Ciphertext distribution at position 3 0.00395 0.00395 0.00395 ... ... Probability Probability Probability 0.00390625 0.00390625 0.00390625 0.003878 0.003878 0.003878 0 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 255 0 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 255 0 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 255 Byte value [0...255] Byte value [0...255] Byte value [0...255] ... Z 1 Z 2 Z 3 • Revealed many new biases in the RC4 keystream • (Some of these were independently discovered by [Isobe et al. 2013]) 12

Keystream Distribution at Position 1 Ciphertext distribution at position 1 0.00395 0.003950 Probability Probability 0.00390625 0.003906 0.003878 0.003878 0 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 255 Byte value [0...255] Byte value

Plaintext Recovery • Based on the keystream byte distribution, we can construct a plaintext recovery attack • Exploits all single-byte biases in the initial part of the RC4 keystream • Attack requires the same plaintext to be encrypted under many di ff erent keys • Applicable when using TLS? 29

Targeting Secure HTTP Cookies TLS Secure cookie TLS HTTP request (cookie attached) Malicious https://secure.com Client server • Javascript • Uses XMLHttpRequest objects to generate POST requests • Request to secure site possible due to Cross-Origin Resource Sharing • Number of requests generated by script must be balanced to avoid browser overload 30

On the Security of RC4 in TLS Nadhem AlFardan, Dan Bernstein, Kenny - PowerPoint PPT Presentation

On the Security of RC4 in TLS Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering, Jacob Schuldt Royal Holloway, University of London University of Illinois at Chicago http://www.isg.rhul.ac.uk/tls/ Agenda Brief overview of

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Security Security as term, Possible Security violations Authentication Criteria for

CPSC410/611: Security Security Security Attacks Security Threats Crypto

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Security Overview Security Goals The Attack Space Security Mechanisms

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Overview Security Goals The Attack Space Security Mechanisms

International and Global Security 1 Peer Discussion What is security? 2 International

Security 101 Definition of Information Security Information security is the protection of

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Com puter Security Part One Security as a subject Security is an old problem in the

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Election Security and Integrity What is election security? What is election integrity? Election

Computer Security environment, without compromising functionality or security? Three parts

Network Security Where we are in the Course Security crosses all layers Applicatjon