How to Backdoor Diffie-Hellman
•
0 likes•737 views
Lately, several backdoors in cryptographic constructions, protocols and implementations have been surfacing in the wild: Dual-EC in RSA's B-Safe product, a modified Dual-EC in Juniper's operating system ScreenOS and a non-prime modulus in the open-source tool socat. Many papers have already discussed the fragility of cryptographic constructions not using nothing-up-my-sleeve numbers, as well as how such numbers can be safely picked. However, the question of how to introduce a backdoor in an already secure, safe and easy to audit implementation has so far rarely been researched (in the public). We present two ways of building a Nobody-But-Us (NOBUS) Diffie-Hellman backdoor: a composite modulus with a hidden subgroup (CMHS) and a composite modulus with a smooth order (CMSO). We then explain how we were able to subtly implement and exploit it in a local copy of an open source library using the TLS protocol.
More Related Content
What's hot
What's hot (12)
Viewers also liked
Viewers also liked (11)
Similar to How to Backdoor Diffie-Hellman
Similar to How to Backdoor Diffie-Hellman (20)
Recently uploaded
Recently uploaded (20)
How to Backdoor Diffie-Hellman
- 1. HOW TO BACKDOOR DIFFIE-HELLMANDavid Wong NCC Group
- 2. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 3. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 5. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 6. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https 2014: preloaded-HSTS introduced in Chrome
- 8. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https / Snowden leaks 2014: preloaded-HSTS introduced in Chrome
- 9. TLS pre-2007: Absence of TLS 2007: TLS only for login forms (Graham sniffs gmail cookies live at Blackhat) 2009: Moxie releases SSLstrip at Blackhat 2010: HSTS introduced in Firefox / Firesheep 2013: Facebook is full-https / Snowden leaks 2010/2014: preloaded-HSTS introduced in Chrome
- 12. Logjam
- 13. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 18. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 19. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 20. • hardcoded DHE parameters in Apache • NSA believed to be able to compute discrete logarithm in modulo 1024-bit integers • too much work Logjam
- 21. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 22. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 23. U.S. export rules • weak “Export” Cipher Suites • 512-bit primes for Diffie-Hellman • 40-bit keys for DES
- 25. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 26. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 27. LOTUS NOTES • 64-bit crypto allowed… • …if 24 bits of the key are encrypted to the NSA • NSA’s RSA public key O=MiniTruth CN=Big Brother
- 28. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 29. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 30. Kleptography • A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor. • A secure kleptographic attack is undetectable as long as the cryptosystem is a black-box. • what about white-box? Reverse Engineering?
- 31. • Weak crypto • Kleptography
- 32. Dual EC
- 33. 2007
- 34. CRYPTO 2007
- 35. NSA’s BULLRUN
- 39. Dual EC is obvious.
- 40. • Weak crypto • Kleptography • New Backdoored Algorithms
- 43. DHE backdoor?
- 44. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 45. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 46. DHE backdoor? • Everyone trust DHE already • Logjam: hardcoded DHE everywhere • Everyone is upgrading to 2048-bit parameters
- 52. Agenda 1. Group Theory 2. Attacks on DH 3. Construct a backdoor 4. Construct a NOBUS backdoor
- 53. Known attacks against DHGroup Theory
- 54. Known attacks against DHGroup Theory Alice’s
- 55. Known attacks against DHPohlig-HellmanGroup Theory
- 56. Known attacks against DHPohlig-HellmanGroup Theory
- 57. Known attacks against DHPohlig-HellmanGroup Theory
- 58. Known attacks against DHPohlig-HellmanGroup Theory
- 59. Known attacks against DHPohlig-HellmanGroup Theory
- 60. Known attacks against DHPohlig-HellmanGroup Theory
- 61. Known attacks against DHPohlig-HellmanGroup Theory
- 62. Known attacks against DHPohlig-HellmanGroup Theory
- 64. Known attacks against DH
- 65. Known attacks against DHDiffie-HellmanKnown attacks against DH
- 66. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 67. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 68. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 69. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 70. Known attacks against DH • Trial Multiplication • SNFS, GNFS • Shank’s BSGS, Pollard Rho & Kangaroo, … • Small subgroup attacks (active) • Pohlig-Hellman (passive)
- 74. Small Subgroups Attack alice odd even
- 75. Known attacks against DHPohlig-Hellman
- 76. Known attacks against DHPohlig-Hellman
- 77. Prime groups
- 78. Prime groups
- 79. Prime groups
- 80. Prime groups
- 81. CM-HSO Composite Modulus with a Hidden Smooth Order
- 82. CM-HSO Composite Modulus with a Hidden Smooth Order
- 83. CM-HSO Composite Modulus with a Hidden Smooth Order
- 84. CM-HSO Composite Modulus with a Hidden Smooth Order
- 87. DEMO
- 89. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome -> deprecating DHE • migrating to ECDHE
- 90. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome -> deprecating DHE • migrating to ECDHE
- 91. Detect and Protect • Check for prime modulus • Better: check for safe prime modulus • Google Chrome deprecating DHE (-> ECDHE) • migrating to ECDHE
- 92. END how many VPN/libraries/closed-source products are backdoored?
- 93. END how many VPN/libraries/closed-source products are backdoored? what about ECDHE?