- Jul 22, 2014
- 2,525
Three security researchers have discovered a variation to an old cryptographic attack that can be exploited to obtain the private encryption key necessary to decrypt sensitive HTTPS traffic under certain conditions.
Named ROBOT, which stands for Return Of Bleichenbacher's Oracle Threat, this new attack is a variation of the Bleichenbacher attack on the RSA algorithm discovered almost two decades ago.
The original Bleichenbacher attack
Back in 1998, Daniel Bleichenbacher of Bell Laboratories discovered a bug in how TLS servers operate when server owners choose to encrypt server-client key exchanges with the RSA algorithm.
By default, before a client (browser) and a server start communicating via HTTPS, the client will choose a random session key that it will encrypt with the server's publicly-advertised key. This encrypted session key is sent to the server, which uses its private key to decrypt the message and save a copy of the session key that it will later use to identify each client.
Because RSA is not a secure algorithm, it also uses a padding system to add an extra layer of random bits on top of the encrypted session key.
Bleichenbacher discovered that if the session key was encrypted with the RSA algorithm and the padding system was PKCS #1 1.5, an attacker could simply send a random session key to the TLS server and ask if it was valid. The server would respond with a simple "yes" or "no."
This meant that by the means of a simple brute-force attack, an attacker could guess the session key and decrypt all HTTPS messages exchanged between the TLS (HTTPS) server and the client (browser).
Bleichenbacher attack protection measures failed
..
...
Named ROBOT, which stands for Return Of Bleichenbacher's Oracle Threat, this new attack is a variation of the Bleichenbacher attack on the RSA algorithm discovered almost two decades ago.
The original Bleichenbacher attack
Back in 1998, Daniel Bleichenbacher of Bell Laboratories discovered a bug in how TLS servers operate when server owners choose to encrypt server-client key exchanges with the RSA algorithm.
By default, before a client (browser) and a server start communicating via HTTPS, the client will choose a random session key that it will encrypt with the server's publicly-advertised key. This encrypted session key is sent to the server, which uses its private key to decrypt the message and save a copy of the session key that it will later use to identify each client.
Because RSA is not a secure algorithm, it also uses a padding system to add an extra layer of random bits on top of the encrypted session key.
Bleichenbacher discovered that if the session key was encrypted with the RSA algorithm and the padding system was PKCS #1 1.5, an attacker could simply send a random session key to the TLS server and ask if it was valid. The server would respond with a simple "yes" or "no."
This meant that by the means of a simple brute-force attack, an attacker could guess the session key and decrypt all HTTPS messages exchanged between the TLS (HTTPS) server and the client (browser).
Bleichenbacher attack protection measures failed
..
...
