A Retrospective on the Use ofExport Cryptographyor,Top 10 Ways Bill Clinton Broke TLS!

David Adrian@davidcadrian

David Adrian@davidcadrianMeanwhile…
1995 — SSLv2 designed, deployed, and deprecated1996 — SSLv3 replaces SSLv2, forms the basis for modern TLS
1999 — TLSv1.0 standardized by the IETF
Contains export cryptography8Export regulations weakened protocol design tothe point where they are directly harmful clientsusing modern cryptography.

Publications
A Messy State of the Union: Taming the Composite State Machines ofTLSKAERBenjamin Beurdouche, Karthikeyan Bhargavan Antoine Delignat-Lavaud, Cedric Fournet, Markulf Kohlweiss,
Alfredo Pironti, Pierre-Yves Strub, Jean-Karim Zinzindohoue
Oakland 2015

FImperfect Forward Secrecy
David Adrian, Karthikeyan Bhargavan, Zakir Durumeric, Pierrick Gaudry, Matthew Green, J. Alex Halderman,
Nadia Heninger, Drew Springall, and Emmanuel Thomé, Luke Valenta, Benjamin VanderSloot, Eric Wustrow,
Santiago Zanella-Béguelin and Paul Zimmermann
CCS 2015

goL

DROWN: Breaking TLS with SSLv2mjaNWODR

Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta,David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, ChristofPaar, and Yuval Shavitt
USENIX 2016

11FREAK

Q: How do you selectively weaken a protocol based on RSA?
A: Use a shorter RSA key!
Q: How do you select which RSA key to use?
A: Convoluted protocol handshake!

Client Hello: client random, ciphers (…RSA…)
Server Hello: server random, chosen cipher
Certificate: certificate chain (public key PK)

Client Key Exchange: EncryptPK(premaster secret)

Kms:= KDF(premaster secret, client random, server random)
Client Finished: EKms(Hash(m1 | m2 | …))
Server Finished: EKms(Hash(m1 | m2 | …))

Client Hello: client random, ciphers (…RSA…)
Server Hello: server random, chosen cipher

Bug: Accepted on

non-export ciphers

Certificate: certificate chain (public key PK)
Server Key Exchange: SignPK(PK512)
Client Key Exchange: EncryptPK512(premaster secret)

Kms:= KDF(premaster secret, client random, server random)
Client Finished: EKms(Hash(m1 | m2 | …))
Server Finished: EKms(Hash(m1 | m2 | …))

512 bits RSA

Client Hello: ciphers (…RSA…)

Attack candecryptServer Hello: cipher: RSA

Client Hello: ciphers (…RSA_EXPORT…)
Server Hello: cipher: EXPORT_RSA

Certificate: certificate chain (public key PK)
Server Key Exchange: SignPK(PK512)
Client Key Exchange: EncryptPK512(premaster secret)
Kms:= KDF(premaster secret, client random, server random)
EKms(Hash(m1 | m2 | …)) [RSA]

EKms(Hash(m1 | m2 | …)) [RSA_EXPORT]

EKms(Hash(m1 | m2 | …)) [RSA]

EKms(Hash(m1 | m2 | …)) [RSA_EXPORT]

Factored byattacker

Cost (USD)

160
120

256,64
128,64

128,16
128,480

lbp 28; td 120
lbp 29; td 120
lbp 29; td 70

256,16
128,64
64,64
64,4

32,16
32,4

16,4
16,4

16,18,1

4,12,11,14021222324
Time (hrs)2526

Factoring as a Service
Luke Valenta, Shaanan Cohney, Alex Liao, Joshua Fried, Satya Bodduluri, Nadia Heninger
FC 2015

https://teespring.com/shop/hobby-tshirts/factoring

Anyone who can spend $100 to factor a server’s RSA export key canimpersonate that server!RSA Export Support
100Support(Trusted HTTPS)

March 3,
2015

36.7%

March 10,
2015

6.5%

March 25,
2016

1.8%

Support (Percent)

Date

RSA Export

10

10.1
6/103

6/101

5/1
115/109

5/107

5/105

5/103

Date

19

Client Vulnerability
Gathered data about clients visiting freakattack.com
Implemented TLS server that sent RSA key exchange on non-export ciphers• Attempted to load subdomain using Javascript•1.2M page loads, 223K (18%) vulnerable
Data is biased and not complete (from 2 days post disclosure)• Users are not deduplicated• Data is from several days after disclosure, browsers were in the process of patching•

Vulnerable Firefox user agents
Of the 223K vulnerable clients, 15.6K (7.0%) identified as Firefox• Mozilla NSS was not vulnerable, this is likely due to client-side MITM proxies• Experimentally confirmed behavior with packet traces of Avast Anti-Virus•

20

Mitigations
Disable RSA export ciphers•

Bugs in state machine are less impactful if bad crypto is disabled

Update OpenSSL/SecureTransport/SChannel•

All libraries were patched in 2015

Details on https://freakattack.com•Instructions on how to patch various server software.

21

FREAK Origins
SSLv3 drafted in the middle of DJB v. US•

FREAK would not have existed if the regulations had been lifted

FREAK is a protocol bug in SSLv3, implementation bug in TLS 1.0••

Need to have clear specifications with well defined edges
Standard should not be OpenSSL

FREAK is caused by interaction between export and non-export•••

Individually, ciphers were implemented correctly
Composing state machines is difficult
Reasoning at both the protocol and implementation level is hard22

LogjamQ: How do you selectively weaken a protocol based on Diffie-Hellman?
A: Use a shorter prime!
Q: How do you select which prime to use?
A: Convoluted protocol handshake!

Logjam
Downgrade attack against TLS
Identical attack flow to FREAK• Server must support export Diffie-Hellman ciphers•

Protocol vulnerability, not implementation bug
Impossible to distinguish export Diffie-Hellman exchange from non-export• Client can only partially mitigate•

Compute 512-bit discrete log instead of factoring 512-bit key
Most work is in 1 week precomputation per prime• Calculate individual discrete logs in less than one minute•26

Client Hello: client random, ciphers (…DHE…)
Server Hello: server random, chosen cipher
Certificate: certificate chain (public key)
Server Key Exchange: p, g, ga, SignCertKey(p, g, ga)
Client Key Exchange: gb

Kms: KDF(gab, client random, server random)
Client Finished: EKms(Hash(m1 | m2 | …))
Server Finished: EKms(Hash(m1 | m2 | …))

512 bit prime

for export DHEciphers

Client Hello: ciphers (…DHE…)

Client Hello: ciphers (…DHE_EXPORT…)

Server Hello: cipher: DHE

Server Hello: cipher: EXPORT_DHE

Certificate: certificate chain (public key)
Server Key Exchange: p512, g, ga, SignCertKey(p512, g, ga)
Client Key Exchange: gb
Kms: KDF(gab, client random, server random)
EKms(Hash(m1 | m2 | …)) [DHE]EKms(Hash(m1 | m2 | …)) [DHE_EXPORT]

EKms(Hash(m1 | m2 | …)) [DHE]EKms(Hash(m1 | m2 | …)) [DHE_EXPORT]

Feasibility
Do real-world servers support export Diffie-Hellman?
How many trusted HTTPS hosts support export DHE? Alexa Top 1M?
• Did people disable export DHE when disabling export RSA?
•Precomputation takes ~1 week. Not feasible for many unique pHow many unique 512-bit primes are used by trusted servers?
• Do implementations regenerate primes?
•Use ZMap and ZGrab••

Implement support for export Diffie-Hellman
Parse out selected Diffie-Hellman parameters29

IPv4 Support

Support (Percent)100

DHE Export

10

10.1
6/1
03

6/1
01

5/1
115/1
09

5/107

5/105

5/103Date30

IPv4 Support

Support (Percent)100

RSA Export
DHE Export1010.1
6/103

6/101

5/1115/109

5/1075/105

5/103

Date31

Top 1M Support
8.5% of the Alexa Top 1M supported DHE_EXPORT
3.4% of the trusted IPv4 supported DHE_EXPORT
Prime

Popularity among Top 1M domains

Apache mod_ssl

82%

nginx

10%

Other (463 primes)

8%32

Implications for Standards
Standardized groups are Diffie-Hellman best practiceMany attacks on invalid groups, safer to standardize ahead of time
• Need to choose strong enough groups for full lifetime of protocol•Don’t want to standardize weak groups
TLS would need groups strong enough to last longer than two decades• Why standardize export groups when the regulations were being overturned?
•Standardized groups encourage monoculture
Could make impact of a 1024-bit break worse• Want to move to ECDHE instead•

33

MitigationsBrowsers-

No longer support 512-bit-

Will be sunsetting 768-bit and 1024-bit-

Chrome canary has fully disabled DHE-

ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY

Server Operators-

Disable DHE_EXPORT-

Move to 2048-bit or elliptic curve variant (ECDHE)

34DROWN

Q: How do you selectively weaken a protocol that uses symmetricciphers?
A: Send N - 5 bytes of the key in cleartext!

State of SSLv2
SSLv2 is already known to be broken
Does not authenticate handshake• Only used for one year (1995), officially deprecated in 2011•

FREAK and Logjam show harms of supporting obsolete cryptography
Conventional wisdom for servers was to support all ciphers for compatibility• Recent work has shown this advice to be actively harmful•

Is SSLv2 a harmless vestige, or can it be used to attack modern TLS?
SSLv2 has export ciphers, how does this affect modern TLS?
• Do servers still support SSLv2 for compatibility? Are people actually using SSLv2?
•38

Top 1M SSLv2 Support
Fraction of Top N Domains

1SSLv2
TLS

0.8

0.6

0.4

0.2

01e

10101010

10

1600

0+000

00

00

0Rank
39

Non-HTTPS SSLv2
All Certificates

Trusted Certificates

ProtocolPortTLS

SSLv2

TLS

SSLv2

SMTP

25

3,357 K936 K (28%)

1,083 K

190 K (18%)

POP3110

4,193 K404 K (10%)

1,787 K

230 K (13%)

IMAP1434,202 K

473 K (11%)

1,781 K

223 K (13%)

HTTPS

443

34,727 K

5,975 K (17%)

17,490 K

1,749 K (10%)

SMTPS

465

3,596 K

291 K (8%)

1,641 K

40 K (2%)

SMTP

587

3,507 K423 K (12%)

1,657 K

133 K (8%)

IMAPS

993

4,315 K853 K (20%)

1,909 K260 K (14%)

POP3S

995

4,322 K884 K (20%)

1,974 K

304 K (15%)

40

DROWN41

Impact of Key Reuse
All Certificates

Trusted Certificates

Protocol Port

TLS

SSLv2

Vulnerable Key

TLS

SSLv2

Vulnerable Key

SMTP

25

3,357 K936 K (28%)

1,666 K (50%)

1,083 K

190 K (18%)

686 K (63%)

POP3

110

4,193 K404 K (10%)

1,764 K (42%)

1,787 K

230 K (13%)

1,031 K (58%)

IMAP

143

4,202 K473 K (11%)

1,759 K (59%)

1,781 K

223 K (13%)

1,022 K (58%)

HTTPS

443

34,727 K 5,975 K (17%) 11,444 K (33%) 17,490 K 1,749 K (10%)

3,931 K (22%)

SMTPS

465

3,596 K

291 K (8%)

1,439 K (40%)

1,641 K

40 K (2%)

949 K (58%)

SMTP

587

3,507 K423 K (12%)

1,464 K (40%)

1,657 K

133 K (8%)

986 K (59%)

IMAPS

993

4,315 K853 K (20%)

1,835 K (43%)

1,909 K260 K (14%)

1,119 K (59%)

POP3S

995

4,322 K884 K (20%)

1,919 K (44%)

1,974 K

304 K (15%)

1,191 K (60%)
42

Early DROWN Patching
Disclosure (March 1)

Still Vulnerable (March 26)

Trusted HTTPS Top 1M

25%

15%

Trusted HTTPS

22%

16%

All HTTPS

33%

28%

43

Special DROWN
Leave no Bleichen-unbachered!
An implementation bug that allows for attackers to man-in-the-middle
secure connections.
Special DROWN
Vulnerable Key

Special DROWN
Vulnerable Name

Trusted HTTPS Top 1M9%

19%

Trusted HTTPS

26%

38%

All HTTPS

26%

—44

Mitigations and Lessons
Fully disable SSLv2
Don’t only disable export ciphers• If only ciphers are disabled, make sure they’re actually disabled (CVE-2015-3197)•Have single-use keys
Usually discussed in the context of signatures vs. encryption• Prudent to use different keys across different protocol versions•

Authenticate the client before sending secret-derived data
DROWN is possible because of the early ServerVerify message• Design protocols to check the client has knowledge of the secret first•

45

Lessons and Implications

Technology Implications
Obsolete cryptography considered harmful
Maintaining support for old services is not harmless backward compatibility• Not just harmful as bloat in modern protocols—existence is also harmful•

Limit complexity
Cryptographic APIs and state machines are often overly complicated• Design protocols to limit implementation mistakes• Design APIs to limit usage mistakes•

Weakened cryptography considered harmful
All forms of export cryptography are now broken• Export RSA (FREAK attack), Export DHE (Logjam), Export symmetric (DROWN)•47Policy Implications
Cryptography regulations have lasting effects
Maintaining support for old services is not harmless backward compatibility• Not just harmful as bloat in modern protocols—existence is also harmful•

Technological evidence opposes backdooring cryptography
Weakened/export cryptography is not the same as a backdoor• Weakened crypto is arguably less intrusive than backdoors, but still devastating• Current state of technology suggests cryptography is fragile enough•

Cannot assign cryptography based on nationality
Internet is global, traffic flows everywhere, CDNs amplify this effect• Can’t technologically say a non-US citizen uses different cryptography•

48

A Retrospective on the Use of Export Cryptography
Attacks
David Adrian@davidcadrian

https://freakattack.com
https://weakdh.org
https://drownattack.com
Contact
https://davidadrian.org