Package: roca-detect
This tool is related toACM CCS 2017 conference paper #124 Return of
the Coppersmith’s Attack: Practical Factorization of Widely Used RSA
Moduli.It enables you to test public RSA keys for a presence of the described
vulnerability.Update 4.11.2017: Python 2.7, 3.4+ supported.Update 30.10.2017: Thepaperof the attack is already online,ACM
version.Update 30.10.2017: The discrete logarithm detector is now implemented
in the Python and used as a default. It detects the structure in the
primes exploited by the factorizing algorithm.Currently the tool supports the following key formats:X509 Certificate, DER encoded, one per file,*.der,*.crtX509 Certificate, PEM encoded, more per file,*.pemX509 Certificate Signing Request, PEM encoded, more per file,*.pemRSA PEM encoded private key, public key, more per file,*.pem(has to have correct header-----BEGINRSA...)SSH public key,*.pub, starting with “ssh-rsa”, one per lineASC encoded PGP key,*.pgp,*.asc. More per file, has to have
correct header-----BEGINPGP...APK android application,*.apkone modulus per line text file*.txt, modulus can bebase64 encoded number, b) hex coded number, c) decimal coded
numberJSON file with moduli, one record per line, record with modulus has
key “mod” (int, base64, hex, dec encoding supported) certificate(s)
with key “cert” / array of certificates with key “certs” are
supported, base64 encoded DER.LDIFF file - LDAP database dump. Any field ending with;binary::is attempted to decode as X509 certificateJava Key Store file (JKS). Tries empty password & some common,
specify more with--jks-pass-filePKCS7 signature with user certificateThe detection tool is intentionally one-file implementation for easy
integration / manipulation.False positiveFalse positive detection rates:Moduli detector: 2^-27Discrete logarithm detector: 2^-154Discrete logarithm detector is implemented only in the Python code, used
as the default detection method.Java and C# code ports are unmaintained since the original publication
and we don’t plan to upgrade these detectors to the more precise method.
However PR are welcome!Online checkerhttps://keychest.net/rocaThe online checker is using the discrete logarithm detector algorithm.Install with pipInstall the detector library + tool withpip(installs all
dependencies):pip install roca-detectLocal installExecute in the root folder of the package:pip install --upgrade --find-links=. .DependenciesIt may be required to install additional dependencies sopipcan
install e.g. cryptography package.CentOS / RHEL:sudo yum install python-devel python-pip gcc gcc-c++ make automake autoreconf libtool openssl-devel libffi-devel dialogUbuntu:sudo apt-get install python-pip python-dev build-essential libssl-dev libffi-dev swigUsageTo print the basic usage:# If installed with pip / manually
roca-detect --help

# Without installation (can miss dependencies)
python roca/detect.pyThe testing tool accepts multiple file names / directories as the input
argument. It returns the report showing how many files has been
fingerprinted (and which are those).Example (no vulnerabilities found):Running recursively on all my SSH keys and known_hosts:$> roca-detect ~/.ssh
2017-10-16 13:39:21 [51272] INFO ### SUMMARY ####################
2017-10-16 13:39:21 [51272] INFO Records tested: 92
2017-10-16 13:39:21 [51272] INFO .. PEM certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. DER certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. RSA key files: . 16
2017-10-16 13:39:21 [51272] INFO .. PGP master keys: 0
2017-10-16 13:39:21 [51272] INFO .. PGP total keys:  0
2017-10-16 13:39:21 [51272] INFO .. SSH keys:  . . . 76
2017-10-16 13:39:21 [51272] INFO .. APK keys:  . . . 0
2017-10-16 13:39:21 [51272] INFO .. JSON keys: . . . 0
2017-10-16 13:39:21 [51272] INFO .. LDIFF certs: . . 0
2017-10-16 13:39:21 [51272] INFO .. JKS certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. PKCS7: . . . . . 0
2017-10-16 13:39:21 [51272] INFO No fingerprinted keys found (OK)
2017-10-16 13:39:21 [51272] INFO ################################Example (vulnerabilities found):Running recursively on all my SSH keys and known_hosts:$> roca-detect ~/.ssh
<b>2017-10-16 13:39:21 [51272] WARNING Fingerprint found in the Certificate</b>
...
2017-10-16 13:39:21 [51272] INFO ### SUMMARY ####################
2017-10-16 13:39:21 [51272] INFO Records tested: 92
2017-10-16 13:39:21 [51272] INFO .. PEM certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. DER certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. RSA key files: . 16
2017-10-16 13:39:21 [51272] INFO .. PGP master keys: 0
2017-10-16 13:39:21 [51272] INFO .. PGP total keys:  0
2017-10-16 13:39:21 [51272] INFO .. SSH keys:  . . . 76
2017-10-16 13:39:21 [51272] INFO .. APK keys:  . . . 0
2017-10-16 13:39:21 [51272] INFO .. JSON keys: . . . 0
2017-10-16 13:39:21 [51272] INFO .. LDIFF certs: . . 0
2017-10-16 13:39:21 [51272] INFO .. JKS certs: . . . 0
2017-10-16 13:39:21 [51272] INFO .. PKCS7: . . . . . 0
2017-10-16 13:39:21 [51272] INFO Fingerprinted keys found: 1
2017-10-16 13:39:21 [51272] INFO WARNING: Potential vulnerability
2017-10-16 13:39:21 [51272] INFO ################################PGP keyIn order to test your PGP key you can export it from your email client
or download it from the PGP key server such ashttps://pgp.mit.edu/You can also usegpgcommand line utility to export your public key:gpg--armor--exportyour@email.com>mykey.ascAdvanced use caseDetection tool extracts information about the key which can be
displayed:roca-detect.py --dump --flatten --indent  ~/.ssh/TLS/SSL detectionTheroca-detect-tlsdetects certificates from remote TLS/SSL ports.
Provide a file with a newline-delimited list ofaddress:portentries
and use that file as input.Example file: tls_list.txtgithub.com:443
google.com:443
internal.example.com:8080Then run:roca-detect-tlstls_list.txtFake moduliIt is possible to generate moduli that passes the moduli fingerprinting
test but actually do not contain structure the factorization algorithm
is using. Dlog moduli test do not mark those as positive.Advanced installation methodsVirtual environmentIt is usually recommended to create a new python virtual environment for
the project:virtualenv ~/pyenv
source ~/pyenv/bin/activate
pip install --upgrade pip
pip install --upgrade --find-links=. .Separate Python 2.7.13We tested tool with Python 2.7.13 and it works (see Travis for more
info). We have reports saying lower versions (<=2.6) do not work
properly so we highly recommend using up to date Python 2.7Usepyenvto install a new Python version locally if you cannot /
don’t want to update system Python.It internally downloads Python sources and installs it to~/.pyenv.git clone https://github.com/pyenv/pyenv.git ~/.pyenv
echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
echo 'export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc
echo 'eval "$(pyenv init -)"' >> ~/.bashrc
exec $SHELL
pyenv install 2.7.13
pyenv local 2.7.13Python 3Detection tools works also with Python 3.4+Docker containerRun via Docker container to avoid environment inconsistency. Dockerfile
source can be audited athttps://hub.docker.com/r/unnawut/roca-detect/.docker run --rm -v /path/to/your/keys:/keys --network none unnawut/roca-detectMake sure to use--rmand--networknoneflags to disable
container’s network connection and delete the container after running.LicensingCode is licensed under permissive MIT license.As there were requests on dual licensing under Apache 2.0 license (due
to some doubts on compatibility) we are licensing the code also under
Apache 2.0 license.Pick license that suits you better, either MIT or Apache 2.0.Language portsThis section contains links to different GIT repositories with language
portsGo