Analyzing Semantic Correctness with Symbolic Execution: A Case Study on PKCS#1 v1.5 Signature Verification

Chau, Sze Yiu; Yahyazadeh, Moosa; Chowdhury, Omar; Kate, Aniket; Li, Ninghui

doi:10.14722/ndss.2019.23430

Cited by 11 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To also allow fast simulations, we used parameters 𝜃 = 8 and ℓ = 24 in our experiments. For the construction of the precomputed table we used 𝑑 = 8 for distinguished fingerprints, 𝑡 max = 2 11 as the maximum chain length, 𝑚 = 2 8 starting points per table, and 𝑟 = 2 8…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

A Time-Memory Trade-Off Attack on WPA3's SAE-PK

Vanhoef

2022

Proceedings of the 9th ACM on ASIA Public-Key Cryptography Workshop

View full text Add to dashboard Cite

To increase the security of Wi-Fi hotspots, the Wi-Fi Alliance released the SAE-PK (Simultaneous Authentication of Equals -Public Key) protocol in December 2020. In this protocol, the password of the network is derived from the public key and the name of the network. The idea is that an adversary cannot, within practical time, generate their own private and corresponding public key that leads to the same password. This prevents an adversary from setting up a rogue Wi-Fi network with the same name and password because they do not have a private and public key that results in the given password.In this paper, we analyze the impact of time-memory trade-off attacks on the security of the SAE-PK protocol. By utilizing distinguished points to construct precomputed tables, we estimate that the amortized cost of attacks can be significantly reused when the name of the Wi-Fi network, called the SSID (Service Sets Identifier), is reused. For instance, we estimate that when an adversary is targeting an SSID used by a large number of networks, the amortized computational costs of attacking the weakest allowed SAE-PK configuration is lowered from 48 CPU years to roughly two weeks. Finally, we also demonstrate how to construct SAE-PK password collisions, where two networks with different SSIDs end up using the same password. Such a password collision enables the creation of a single precomputed table that can attack multiple SSIDs. CCS CONCEPTS• Security and privacy → Cryptanalysis and other attacks; Public key (asymmetric) techniques; Security protocols; • Networks → Network protocol design.

show abstract

Section: Methodsmentioning

confidence: 99%

“…Flexibilities in parsing public keys were previously abused to attack RSA ciphers [11,24]. In this line of work it was also discovered that some libraries accept arbitrary parameters in the algorithm identifier, which was assigned CVE-2018-16151, and they also discovered other parsing flexibilities in cryptographic libraries [7,8].…”

Section: Related Workmentioning

confidence: 99%

A Time-Memory Trade-Off Attack on WPA3's SAE-PK

Vanhoef

2022

Proceedings of the 9th ACM on ASIA Public-Key Cryptography Workshop

View full text Add to dashboard Cite

show abstract

“…Felsch et al [10] proposed the principle of Bleichenbacher oracle attacks against IPsec, showing that it was sufficient to break all the certificate authentication schemes of the IKEv1 and IKEv2 protocols, and discovered specific Bleichenbacher oracle attack vulnerabilities in four router firmware. Chau et al [3] However, none of the aforementioned studies focused on the correctness of IPsec hostname matching. In contrast, a few studies have been conducted on hostname matching in SSL/TLS protocol.…”

Section: Related Workmentioning

confidence: 99%

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

Guo

Chen

et al. 2021

ITC

View full text Add to dashboard Cite

Owing to the advent and rapid development of Internet communication technology, network security protocols with cryptography as their core have gradually become an important means of ensuring secure communications. Among numerous security protocols, certificate authentication is a common method of identity authentication, and hostname verification is a critical but easily neglected process in certificate authentication. Hostname verification validates the identity of a remote target by checking whether the hostname of the communication partner matches any name in the X.509 certificate. Notably, errors in hostname verification may cause security problems with regard to identity authentication. In this study, we use a model-learning method to conduct security testing for hostname verification in internet protocol security (IPsec). This method can analyze the problems entailed in implementing hostname verification in IPsec by effectively inferring the deterministic finite automaton model that can describe the matching situation between the certificate subject name and the hostname for different rules. We analyze two popular IPsec implementations, Strongswan and Libreswan, and find five violations. We use some of these violations to conduct actual attack tests on the IPsec implementation. The results show that under certain conditions, attackers can use these flaws to carry out identity impersonation attacks and man-in-the-middle attacks.

show abstract

“…In the past decade, symbolic execution has emerged as a powerful formal verification technique and been widely applied in the analysis and verification of network protocol and network function implementations. For example, in [14], [15], the authors employ symbolic execution to extract the accept and reject paths in essential components of the TLS protocol, i.e., X.509 certificate validation and PKCS#1 signature verification, to find semantic bugs by cross-validating different implementations. Kothari et al [27] use symbolic execution to find protocol manipulation attacks where a malicious endhost can induce a remote peer to send more packets more aggressive than it should.…”

Section: Related Workmentioning

confidence: 99%

SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery

Wang

Zhu

Cao

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

A key characteristic of commonly deployed deep packet inspection (DPI) systems is that they implement a simplified state machine of the network stack that often differs from that of endhosts. The discrepancies between the two state machines have been exploited to bypass such DPI based middleboxes. However, most prior approaches to do so rely on manually crafted adversarial packets, which not only are labor-intensive but may not work well across a plurality of DPI-based middleboxes. Our goal in this work is to develop an automated way to craft candidate adversarial packets, targeting TCP implementations in particular. Our approach to achieving this goal hinges on the key insight that while the TCP state machines of DPI implementations are obscure, those of the endhosts are well established. Thus, in our system SYMTCP, using symbolic execution, we systematically explore the TCP implementation of an endhost, identifying candidate packets that can reach critical points in the code (e.g., which causes the packets to be accepted or dropped/ignored); such automatically identified packets are then fed through the DPI middlebox to determine if a discrepancy is induced and the middlebox can be eluded. We find that our approach is extremely effective. It can generate tens of thousands of candidate adversarial packets in less than an hour. When evaluating against multiple state-of-the-art DPI systems such as Zeek and Snort, as well as a state-level censorship system, viz. the Great Firewall of China, we identify not only previously known evasion strategies, but also novel ones that were never previously reported (e.g., involving the urgent pointer). The system can be extended easily towards other combinations of operating systems and DPI middleboxes, and serves as a valuable tool for testing future DPIs' robustness against evasion attempts.

show abstract

Analyzing Semantic Correctness with Symbolic Execution: A Case Study on PKCS#1 v1.5 Signature Verification

Cited by 11 publications

References 11 publications

A Time-Memory Trade-Off Attack on WPA3's SAE-PK

A Time-Memory Trade-Off Attack on WPA3's SAE-PK

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery

Contact Info

Product

Resources

About