4 ms·

The attacker lets the handshake complete normally and then intercepts the transmission of the encrypted record that contains the secret that they wish to decryp

by agl 14y ago

The attacker lets the handshake complete normally and then intercepts the transmission of the encrypted record that contains the secret that they wish to decrypt. (Assuming that the parties negotiated a CBC ciphersuite.) The attacker can then alter the encrypted record and send it onwards to the server. Because the record has been altered, the server will reject it and close the connection. However, the amount of time that it takes to reject the record reveals something about the plaintext padding. If the client will repeatedly send the same plaintext secret (e.g. HTTP cookie) over many connections (e.g. a web browser repeatedly requesting a resource) then the attacker can learn a little from each connection and, after thousands of connections, start to decrypt the secret.

ajross 14y ago
> However, the amount of time that it takes to reject the record reveals something about the plaintext padding. This is the part I don't get. Symmetric cyphers in CBC mode don't traditionally behave that way. You encrypt the block and get your answer. Is there a variable-length HMAC in there somewhere or something?
- agl 14y ago
  TLS does CBC wrong: it authenticates the plaintext and then encrypts the plaintext and MAC. Since CBC mode needs to pad its input, this means that the padding is outside of the authentication. So, when decrypting, the padding has to be removed and then the MAC can be checked. But the number of blocks hashed in the MAC depends on the padding. So the attacker can setup the padding such that a valid padding means that it's removed and one less hash block is calculated. An invalid padding isn't removed and the MAC takes one more hash-block worth of time. Thus the attacker can tell whether a padding was valid and that's sufficient to completely break TLS.
  - Bootvis 14y ago
    How is it sufficient to know the padding to break TLS? I thought that if you know the padding, you only know the message length.
    - caf 14y ago
      The attacker has an unknown plaintext byte P, and due to the way CBC mode works (together with the timing attack), is able to test if (P xor X) is a valid padding byte with X chosen by the attacker. Once the attacker finds an X that makes a valid padding byte, she can trivially determine P.
- deleted 14y ago
  [deleted]

by agl 14y ago

ajross 14y ago

> However, the amount of time that it takes to reject the record reveals something about the plaintext padding. This is the part I don't get. Symmetric cyphers in CBC mode don't traditionally behave that way. You encrypt the block and get your answer. Is there a variable-length HMAC in there somewhere or something?

agl 14y ago
TLS does CBC wrong: it authenticates the plaintext and then encrypts the plaintext and MAC. Since CBC mode needs to pad its input, this means that the padding is outside of the authentication. So, when decrypting, the padding has to be removed and then the MAC can be checked. But the number of blocks hashed in the MAC depends on the padding. So the attacker can setup the padding such that a valid padding means that it's removed and one less hash block is calculated. An invalid padding isn't removed and the MAC takes one more hash-block worth of time. Thus the attacker can tell whether a padding was valid and that's sufficient to completely break TLS.
- Bootvis 14y ago
  How is it sufficient to know the padding to break TLS? I thought that if you know the padding, you only know the message length.
  - caf 14y ago
    The attacker has an unknown plaintext byte P, and due to the way CBC mode works (together with the timing attack), is able to test if (P xor X) is a valid padding byte with X chosen by the attacker. Once the attacker finds an X that makes a valid padding byte, she can trivially determine P.
deleted 14y ago
[deleted]