Attacks on Cryptoprocessor Transaction Sets

Bond, Mike

doi:10.1007/3-540-44709-1_19

Cited by 48 publications

(67 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, a data key would be encrypted under KM⊕DATA. 2 Keys encrypted in this manner are known as working keys and are stored outside of the security module. They can then only be used by sending them back into the HSM under the desired API command.…”

Section: Analysing the Ibm Recommendations Using Cl-atsementioning

confidence: 99%

“…The intruder's initial knowledge includes an unknown working key of each type, to reflect that fact that even if he does not already have such keys, he can always 'conjure' one by repeatedly trying random values against a command, [2, §3.4]. In addition, he is given all the initial knowledge assumed by Bond in his attacks, [2], which includes a key part K3, a partially completed importer key {|KEK⊕K3| } KM⊕KP⊕IMP , a PIN derivation key PDK encrypted under transport key KEK, and a customer's account number PAN. For standard security protocols, we would be interested in model checking properties such as the secrecy of a newly agreed session key, i.e.…”

Section: Modelling the Apimentioning

confidence: 99%

See 1 more Smart Citation

Automatic Analysis of the Security of XOR-Based Key Management Schemes

Cortier

Keighren

Steel

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. We describe a new algorithm for analysing security protocols that use XOR, such as key-management APIs. As a case study, we consider the IBM 4758 CCA API, which is widely used in the ATM (cash machine) network. Earlier versions of the CCA API were shown to have serious flaws, and the fixes introduced by IBM in version 2.41 had not previously been formally analysed. We first investigate IBM's proposals using a model checker for security protocol analysis, uncovering some important issues about their implementation. Having identified configurations we believed to be safe, we describe the formal verification of their security. We first define a new class of protocols, containing in particular all the versions of the CCA API. We then show that secrecy after an unbounded number of sessions is decidable for this class. Implementing the decision procedure requires some improvements, since the procedure is exponential. We describe a change of representation that leads to an implementation able to verify a configuration of the API in a few seconds. As a consequence, we obtain the first security proof of the fixed IBM 4758 CCA API with unbounded sessions.

show abstract

Section: Analysing the Ibm Recommendations Using Cl-atsementioning

confidence: 99%

Section: Modelling the Apimentioning

confidence: 99%

Automatic Analysis of the Security of XOR-Based Key Management Schemes

Cortier

Keighren

Steel

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…Given that many attacks against APIs rely on logical flaws rather than weak cryptography a large body of work addresses their security using symbolic models. The first set of attacks were discovered by Longley and Rigby [19], Bond [3], and Clulow [7]. [14] and Cortier and Steel [9] analyze a fragment of the of PKCS#11 standard.…”

Section: Instantiating a Km-apimentioning

confidence: 99%

“…The standards typically lack a clearly defined security goal, let alone a rigorous analysis that any security claim is reasonably met. As a result, proper deployment relies strongly on best practices (undocumented in the public domain); moreover, tokens are subject to regular successful attacks [2][3][4]7]. This raises the question whether the security of cryptographic APIs can be captured and compartmentalized, taking into account the reality that some keys will leak.…”

mentioning

confidence: 99%

A Modular Treatment of Cryptographic APIs: The Symmetric-Key Case

Shrimpton

Stam

Warinschi

2016

Advances in Cryptology – CRYPTO 2016

View full text Add to dashboard Cite

Abstract. Application Programming Interfaces (APIs) to cryptographic tokens like smartcards and Hardware Security Modules (HSMs) provide users with commands to manage and use cryptographic keys stored on trusted hardware. Their design is mainly guided by industrial standards with only informal security promises. In this paper we propose cryptographic models for the security of such APIs. The key feature of our approach is that it enables modular analysis. Specifically, we show that a secure cryptographic API can be obtained by combining a secure API for key-management together with secure implementations of, for instance, encryption or message authentication. Our models are the first to provide such compositional guarantees while considering realistic adversaries that can adaptively corrupt keys stored on tokens. We also provide a proof of concept instantiation (from a deterministic authenticated-encryption scheme) of the key-management portion of cryptographic API.

show abstract

“…Another benefit of utilizing HSMs is that they define the point at which any abuse of the key material may occur; so whilst a given HSM may not be truly secure (e.g. it may be susceptible to API attacks [6,8]), nor may they require authentication of the caller, they do from a pragmatic point of view provide the location where any abuse by an attacker will occur.…”

Section: Introductionmentioning

confidence: 99%

The Low-Call Diet: Authenticated Encryption for Call Counting HSM Users

Bond

French

Smart

et al. 2013

Topics in Cryptology – CT-RSA 2013

Self Cite

View full text Add to dashboard Cite

.Abstract. We present a new mode of operation for obtaining authenticated encryption suited for use in environments, e.g. banking and government, where cryptographic services are only available via a Hardware Security Module (HSM) which protects the keys but offers a limited API. The practical problem is that despite the existence of better modes of operation, modern HSMs still provide nothing but a basic (unauthenticated) CBC mode of encryption, and since they mediate all access to the key, solutions must work around this. Our mode of operation makes only a single call to the HSM, yet provides a secure authenticated encryption scheme; authentication is obtained by manipulation of the plaintext being passed to the HSM via a call to an unkeyed hash function. The scheme offers a considerable performance improvement compared to more traditional authenticated encryption techniques which must be implemented using multiple calls to the HSM. Our new mode of operation is provided with a proof of security, on the assumption that the underlying block cipher used in the CBC mode is a strong pseudorandom permutation, and that the hash function is modelled as a random oracle.

show abstract

Attacks on Cryptoprocessor Transaction Sets

Cited by 48 publications

References 2 publications

Automatic Analysis of the Security of XOR-Based Key Management Schemes

Automatic Analysis of the Security of XOR-Based Key Management Schemes

A Modular Treatment of Cryptographic APIs: The Symmetric-Key Case

The Low-Call Diet: Authenticated Encryption for Call Counting HSM Users

Contact Info

Product

Resources

About