On the (in)security of IPsec in MAC-then-encrypt configurations

Abstract

IPsec allows a huge amount of flexibility in the ways in which its component cryptographic mechanisms can be combined to build a secure communications service. This may be good for supporting different security requirements but is potentially bad for security. We demonstrate the reality of this by describing efficient, plaintext-recovering attacks against all configurations of IPsec in which integrity protection is applied prior to encryption -so-called MAC-then-encrypt configurations. We report on the implementation of our attacks against a specific IPsec implementation, and reflect on the implications of our attacks for real-world IPsec deployments as well as for theoretical cryptography.

On Symmetric Encryption with Distinguishable Decryption Failures

“…For example, attacks on TLS in [10,2,3] and IPsec in [12] exploit weaknesses in specific MtE constructions, while attacks against deployed EtM constructions seem rarer.…”

“…Other examples in the asymmetric setting were subsequently discovered [15,20] and called reaction attacks. Vaudenay then showed that similar issues can arise in the symmetric setting [26], and his ideas were extended to produce significant attacks against (among others) SSL/TLS [10,22], IPsec [11,12], ASP.NET [13], XML encryption [18] and DTLS [2]. Analysis of error messages in the symmetric setting was also crucial to the success of attacks against the SSH Binary Packet Protocol [1].…”

Beyond Modes: Building a Secure Record Protocol from a Cryptographic Sponge Permutation

“…During the 10-15 years since the protocols of Section 2 largely took their present form, a large number number of security proofs, counter-proofs and attacks have been presented, starting with [38][39][40] and [23,[41][42][43][44] representing some of the more recent work.…”

Authenticated encryption: how reordering can impact performance

“…Although significant efforts have been devoted to analyzing the security implications of different generic compositions (see, e.g., [11,12,22,27,49,52]), little effort has been devoted to the study of the performance implications of different generic compositions [7]. Of particular interest to this work is the performance aspect of generic compositions when the encryption algorithm is blockcipher based and the MAC algorithm is universal hash-function family based.…”