Diffie-Hellman key exchange is one of the most common public-key cryptographic methods in use in the Internet. It is a fundamental building block for IPsec, SSH, and TLS. Diffie-Hellman key exchange allows two parties to agree on a shared secret in the presence of an eavesdropper. Since the security of Diffie-Hellman relies crucially on the group parameters, implementations can be vulnerable to an attacker who provides maliciously generated parameters that change the properties of the group. In January 2016 we found a vulnerability affecting OpenSSL leveraging indeed this kind of attack (CVE-2016-0701). The research made while studying OpenSSL code base also highlighted a semi-mysterious RFC (RFC 5114 – “Additional Dif e-Hellman Groups for Use with IETF Standards”) originating from Defense contractor BBN. The mathematical property of the groups introduced in RFC 5114 were of particular interest since made OpenSSL particularly susceptibleto a Key Recovery Attack.

1. How to defend from an
attacker armed with a
mathematician
Antonio Sanso (@asanso)
Senior Software Engineer
Adobe Research Switzerland

2. Who is this guy, BTW?
{ Senior Software Engineer Adobe Research Switzerland
{ Internet Bug Bounty, Google Security Hall of Fame, Facebook Security
Whitehat, GitHub Security Bug Bounty, Microsoft Honor Roll
{ Found vulnerabilities in OpenSSL , Google Chrome, Apple Safari
{ Co-Author of “OAuth 2 in Action”
{ Obsessed by prime numbers
★

3. TLS (Transport Layer Security)

4. TLS
TLS Flow (highly simplified)
asymmetric crypto
(e.g. RSA/DH)
+
Client Server
m
m = premaster key
symmetric crypto
(e.g. AES)

5. TLS
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Key Exchange
Cipher
MAC or PRF

6. +
Key Exchange
Client Server
m = premaster key

8. Math Ahead !!
{Addition
{Multiplication
{Exponentiation
{Modular arithmetic

9. Public key cryptography

10. One way functions
x f(x
)
easy
extremely hard

11. Discrete log problem
y = gx (mod p) EASY!
Example
p = 17
g = 3
x = 4
y = 34 (mod 17) = ?
y = 34 = 81 (mod 17) = 13

12. Discrete log problem
dlogg y HARD!
How much hard? Trivial alg. O(p)
We need do find 0 < x < p-1 s.t. gx= y (mod p)
Example
p = 17
g = 3
y = 10 x = ??
x = 0 y = 30 = 1 (mod 17)
x = 1 y = 31 = 3 (mod 17)
x = 2 y = 32 = 9 (mod 17)
x = 3 y = 33 = 10 (mod 17)
★

13. Discrete log problem
p =
218473595898882084755067249171622650635714019853253703676313
617811140296530259568151576053281904111410441606898157413193
811965329798715000389798623091587382509451185549616268241523
075366058726165028842888780624670527776052278467097818506147
927484588389513422048126018381129378053717826003801060205228
844064528238188244556839820428829281834311945931891714310663
711385102529796485135530787625845961474274568372896230088793
648294777051836361493041209989486542781338740267111884943117
708835148893633513800645204134596026961413539494079718100718
483541278687259340578110522855117260709519548286257619847978
31079801857828431

14. Discrete log problem

15. +
Key Exchange
Client Server
g,p
yb g, p
yb = gb (mod p)
Ephemeral
Random b
TLS_DHE_RSA_WITH_AES_128….

16. +
Key Exchange
Client Server
g,p
yb,g, p
yb = gb (mod p)ya = ga (mod p)
ya

17. +
Key Exchange
Client Server
m = premaster key
yb
ya
m = gba (mod p)
(yb)a = (gb)a = gba (mod p)
m = gab (mod p)
(ya)b = (ga)b = gab (mod p)
yb = gb (mod p)
ya = ga (mod p)
★

18. OpenSSL Key Recovery Attack on DH small
subgroups (CVE-2016-0701)

19. Server
g,p
yb g, p
yb = gb (mod p)
ya
OpenSSL Key Recovery Attack on DH small
subgroups (CVE-2016-0701)
★

20. Attack Requirement #1
(Static ephemeral keys)
Server
g,p
m = premaster key
yb g, p
yb = gb (mod p)
By default NOT
ephemeral
SSL_OP_SINGLE_DH_USE wasn’t set
★

21. Server
g,p
yb,g, p
yb = gb (mod p)ya = ga (mod p)
ya
Attack Requirement #2
(Not verifying the incoming value)
m = gab (mod p)
(ya)b = (ga)b = gab (mod p)
★

22. Discrete log problem
What about p? Which prime number should I choose?
OBSERVATION: (p-1) is always even
{ Safe prime ==> (p -1)/2 is also prime (many RFCs)
{ Or at least == > (p -1)/2 should not be a product of small
primes

23. RFC 5114 - O(224)
p = 2048 bit
g = >>2
q = 224
p -1 /2 = 2 * 3 * 3 * 5 * 43 * 73 * 157 * 387493 * 605921 *
5213881177 * 3528910760717 * 83501807020473429349
* C489 (where C489 is a 489 digit composite number with
no small factors).
★

24. Attack Requirement #3
(Product of small primes)
RFC
5114
m = premaster key
yb g, p
yb = ga (mod p)

25. Attack succeeded!!
RFC
5114
m = premaster key
yb g, p
yb = gb (mod p)
By default NOT
ephemeral
★
ya = ga (mod p)
ya
So we can compute:
{ b mod (2)
{ b mod (3)
{ …
{ b mod (5213881177)
Finally we can combine the
result using the Chinese
Remainder Theorem (CRT)!!

26. History of RFC 5114
...a semi-mysterious RFC 5114 – Additional Diffie-
Hellman Groups document. It introduces new MODP
groups not with higher sizes, but just with different primes.
… no one really wanted these, but no one really objected
to it either, so the document (originating from Defense
contractor BBN) made it to RFC status.

27. References
{ https://www.openssl.org/news/secadv/20160503.txt
{ http://blog.intothesymmetry.com/2016/01/openssl-key-recovery-attack-
on-dh-small.htmlMultiplication
{ http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.44.5296
{ http://arstechnica.com/security/2016/01/high-severity-bug-in-openssl-
allows-attackers-to-decrypt-https-traffic/

28. Questions?

29. Additional material

30. Discrete log function
Primitive root (generator)
Example
p = 17
Generator g = 3
{30,31,32,33,34,35,36, … } ==> {1, 3, 9, 10, 13, 5, 15, …}

31. OpenSSL Key Recovery Attack on DH small
subgroups (CVE-2016-0701)
Server
g,p
yb g, p
yb = ga (mod p)
Choose B s.t. ord(B) is small
ya = gaB (mod p)
(yb)aBj = gbaBj
ya
(ya)b = (gaB)b = gabBb (mod p)
0 < j < ord(B) == > small
B = j mod (ord(B))
★

32. RFC 5114
p -1 /2 = 2 * 3 * 3 * 5 * 43 * 73 * 157 * 387493 * 605921 *
5213881177 * 3528910760717 * 83501807020473429349
* C489 (where C489 is a 489 digit composite number with
no small factors).
• ∃ gi s.t. q = 2
• ∃ gi s.t. q = 3
• ∃ gi s.t. q = 5
• …
from O(224) to O(44)

33. OpenSSL Key Recovery Attack on DH small
subgroups - Validation
Server
g,p
yb g, p
yb = ga (mod p)
Choose B s.t. ord(B) is small
ya = gaB (mod p)
ya
VALIDATION
Check that
ya
q (mod p) = 1
★

34. Chinese Remainder Theorem (CRT)
b = l (mod ord(B1))
b = m (mod ord(B2))
b = n (mod ord(B3))
We can find a unique solution
mod(ord(B1) * ord(B2) * ord(B3))
★

35. “Trap door” one way functions
x f(x
)
easy
extremely hard
easy given t
t