Computer Security 2014 – Ymir Vigfusson Some slides borrowed from Luis von Ahn‘s 15-251 class @ CMU

On randomnessComputer Security 2014 – Ymir Vigfusson

Some slides borrowed from Luis von Ahn‘s 15-251 class @ CMU

2

Plan for today

Suppose we want to communicate securely when an adversary can intercept us and do MITM attacks Think back to the problem the Enigma tried

to solve We‘ve learned that one-time pad is secure▪ But we cannot practically exchange keys that long

Issue: Machines are inherently deterministic▪ Strength of encryption scheme at best as good as

the key▪ The building block of modern encryption is

randomness

We will learn how this is done today assuming we have random numbers at our disposal The famous RSA protocol

3

Plan for today

Part 1: Assuming we have random numbers, how can we do secure message exchange? That is, how does RSA work?

Part 2: But how can we create random numbers? Computers make do with pseudo-random

numbers

Part 3: Pitfalls of pseudo-random number generators (PRNGs) PHP session IDs Various Internet attacks (including on RSA)

How do you compute…

58

First idea:

5 52 53 54 55 56 57 58

= 5*5= 52*5

using few multiplications?


58

Better idea:

5 52 54 58

= 5*5= 52*52= 54*54

Used only 3 multsinstead of 7 !!!

Repeated squaring calculatesa2k

in k multiply operations

compare with(2k – 1) multiply

operationsused by the naïve

method


513

516

too high! what now?

assume no divisions allowed…

Use repeated squaring again?

5 52 54 58


513

Use repeated squaring again?

5 52 54 58

Note that 13 = 8+4+1

So a13 = a8 * a4 * a1

Two more multiplies!

1310 = (1101)2

To compute am

Suppose 2k ≤ m < 2k+1

a a2 a4 a8

This takes k multiplies

Now write m as a sum of distinct powers of 2

am = a2k * a2i1 * … * a2it

a2k. . .

say, m = 2k + 2i1 + 2i2 … + 2it

at most k more multiplies

Hence, we can compute am (mod n)

while performing at most 2 log2 m multiplies

where each time we multiplytogether numbers

with log2 n + 1 bits


513 (mod 11)

First idea: Compute 513 using 5 multiplies

5 52 54 58 512 513

= 58*54= 512*5

then take the answer mod 11

= 1 220 703 125

1220703125 (mod 11) = 4


513 (mod 11)

Better idea: keep reducing the answer mod 11

5 52 54 58 512 513

11 3 11 911 81 11 36 11 1511 4 11 3 11 4

25

Pretty good! We‘ll come back to this in a bit

Zn = {0, 1, 2, …, n-1}

Zn* = {x Zn | GCD(x,n) =1}

Now, recall the following:

Examples:

Z8 = {1, 3, 5, 7}Z11 = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}

Euler Phi Function Φ(n)

Φ(n) = size of Zn*

p prime Φ(p) = p-1

p, q distinct primes Φ(pq) = (p-1)(q-1)


5121242653 (mod 11)

The current best idea would stillneed about 54 calculations

answer = 4

We can actually do better using Φ(n):

Importantly, we can do this fast!

for a Zn*, ax n ax mod Φ(n)

Euler’s Theorem

For a Zn*, a Φ(n) = 1 mod n

Corollary: Fermat’s Little Theorem

For p prime, a Zp* ap-1 = 1 mod p

Key result needed, and the key to RSA

Pick secret, random large primes: p,q Multiply n = p*q

“Publish”: n

(n) = (p) (q) = (p-1)*(q-1)Pick random e Z*

(n)

“Publish”: e

Compute d = inverse of e in Z*(n)

Hence, e*d = 1 [ mod (n) ]“Private Key”: d

RSA algorithm

n,e is my public key. Use it to

send me a message.

p,q random primese random Z*

(n)

n = p*qe*d = 1 [ mod (n) ]

n, e

p,q prime, e random Z*(n)

n = p*qe*d = 1 [ mod (n) ]

message m

me [mod n]

(me)d n m

?

p=11,q=3 primes, e = 3

n = p*q = 33

message m=7

?

?

How hard is cracking RSA?

If we can factor products of two large primes, can we crack RSA?

If we know n and Φ(n), can we crack RSA?

How about the other way? Does cracking RSA mean we must do one of these two?

We don’t know (yet)…

22

Part 2: Can we create random numbers? RSA relies fundamentally on availability of

random numbers Random primes p and q, and random exponent e

However, computers by themselves cannot generate random numbers! They are, as we said before, fundamentally

deterministic Need external sources, and to use those sparingly

Khan academy has a nice introduction to the topic https://

www.khanacademy.org/computing/computer-science/cryptography/crypt/v/random-vs-pseudorandom-number-generators

https://www.khanacademy.org/computing/computer-science/cryptography/crypt/v/random-vs-pseudorandom-number-generators





23

How do we create random numbers? You could buy an exciting book!

http://www.amazon.com/Million-Random-Digits-Normal-Deviates/dp/0833030477

You could hook up a Lava lamp!

... or a Geiger counter

Not terribly practical!





24

How do we create random numbers? In practice we use pseudo-random

number generators (PRNGs)

Rely on external sources for initial randomness Here is the diagram for the Linux PRNGs:

25

How do we create random numbers? PRNG PDF

26

Part 3: Weaknesses in PRNGs

In 2012, two research groups looked at gcd(n1,n2) for RSA public keys on the Internet (e.g. SSL/SSH) If any pair of keys share a prime, easy to

crack!

A wide range of devices (routers, firewalls, VPN...) had these weak keys Too little entropy on the devices to

generate strong keys

27

Weaknesses in PRNGs

Dual_EC_DRBG NSA backdoor PRNG designed in 2000s based on elliptic curves Makes use of some magic values P and Q. ▪ Shown in 2007 that if someone deliberately created these

values, they could decrypt traffic after seeing only 32 random bytes

RSA adopts Dual_EC_DRBG as default in BSAFE in 2004▪ Not used by OpenSSL and others, however.

Standardized by NIST in 2005 Snowden‘s leaks in 2013 reveal NSA placed a backdoor▪ „NSA became the only editor of the standard“▪ Paid $10m to RSA to have the company use it as a default

Presidential advisory committee investigating NSA‘s conduct

„Nothing up my sleeve numbers“

28

Internet Cookies

29

Internet Cookies

A user spends effort logging into syndis.is

Web server could require log-in information in each following packet to ensure credentials Cumbersome and expensive

Instead, syndis.is hands out a temporary „badge“ (cookie) to the user User submits copy of the cookie on every request Doesn‘t matter if the user gets a new IP address –

nice!

What if badges were numbered 1, 2, 3, ... ? Need to have cookie strings unpredictable!

30

PHP 5.3.1 Session ID generationFrom php-5.3.1/ext/session/session.c:PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS)…gettimeofday(&tv, NULL);…/* maximum 15+19+19+10 bytes */spprintf(&buf, 0, "%.15s%ld%ld%0.8F", remote_addr, tv.tv_sec, (long int)tv.tv_usec, php_combined_lcg() * 10);…return buf;

31

How much entropy?

Client IP address 4 bytes

Variable Entropy

Client IP address 32-bits

Current epoch 32-bits

Current microseconds (0-1,000,000)

<20-bits

Random value from php_combined_lcg()

64-bits

Total 148-bits

32

Let‘s dissect the components

Can we guess the current epoch?

Session IDs are normally generated when someone logs in

On social networking sites, user appears be visible On Facebook and Gmail, dot turns green „Who‘s logged on“ updated

Can find offset of our time vs. server time using HTTP HEAD request

HEAD / HTTP/1.0

HTTP/1.1 200 OKDate: Mon, 12 Jul 2010 04:30:45 GMTServer: Apache/2.2.3 (CentOS)Last-Modified: Sat, 15 May 2010 00:50:56 GMTRetag: "d664e-66-6267dc00"Accept-Ranges: bytesContent-Length: 102Connection: closeContent-Type: text/html; Charset=UTF-8

33

Let‘s dissect the components

Can we find the victim‘s IP address?

Attacker may already know the address Victim behind common proxy, such as

proxy.emory.edu

Can lure the victim into clicking a link Obtain IP address (Could even do something more nefarious)

So we can usually know the IP address

34

What do we have?

We reduced 148-bits (prehashed) Know 64 of these bits, so 84-bits remaining

Still a feat to crack...

What about the remaining session ID components?

35

How much entropy?

Client IP address 4 bytes

Variable Entropy




<20-bits


64-bits

Total 84-bits

36

Dissecting the PRNG

php_combined_lcg() uses a LCG Linear Congruential Generator, standard PRNG

PHPAPI double php_combined_lcg(void) { php_int32 q, z; if (!LCG(seeded)) { lcg_seed(); } MODMULT(53668, 40014, 12211, 2147483563L, LCG(s1)); MODMULT(52774, 40692, 3791, 2147483399L, LCG(s2)); z = LCG(s1) - LCG(s2); if (z < 1) { z += 2147483562; } return z * 4.656613e-10;}

static void lcg_seed(void) { struct timeval tv; if (gettimeofday(&tv, NULL) == 0) { LCG(s1) = tv.tv_sec ^ (~tv.tv_usec); } else { LCG(s1) = 1; } LCG(s2) = (long) getpid(); LCG(seeded) = 1;}

Pids on UNIX usually 15-bitsCould maybe even find it out...

What‘s going on here?

37

Timestamp manipulation

LCG(s1) = tv.tv_sec ^ (~tv.tv_usec);

1100111001000010110000110010101

1111111111110111010010101110010

tv.tv_sec

Most uncertainMost certain

~tv.tv_usec

XOR

0011000110110101100010011100111

=

Timestamp provides only 20 bits of entropy!

38

Dissecting the PRNG

We have narrowed down the internal state of the random number generator (LCG) to 15+20 bits Specifically variables s1 and s2

How do we make use of this information?

39

PHP 5.3.1 Session ID generationFrom php-5.3.1/ext/session/session.c:PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS)…gettimeofday(&tv, NULL);…/* maximum 15+19+19+10 bytes */spprintf(&buf, 0, "%.15s%ld%ld%0.8F", remote_addr, tv.tv_sec, (long int)tv.tv_usec, php_combined_lcg() * 10);…return buf;

40

Dissecting the PRNG

We just create a session by ourselves! A part of our session ID will be the current

value of php_combined_lcg()

We can then brute force the value that lcg_seed() produced initially We thus know the values of s1 and s2 In other words, we know what

php_combined_lcg() will return before it does!

Important: We calculate the PRNG state locally. No need to send requests to the server

41

How much is left for each session? Client IP address

4 bytesVariable Entropy




<20-bits


64-bits

Total 20-bits

42

PHP attack, summary

The session ID in PHP 5.3.1 has four components.

Client IP address: known by attacker Timestamp in sec: known by attacker Microseconds: unknown

Must brute-force these ~20 bits with individual packets PRNG output:

We create a new session to see the next value of php_combined_lcg()

We brute-force the seed used offline▪ Only (20+15)-bits actually needed because of a bug

We determine how many sessions have been opened on the server to make a good guess

Only need to do this once between PHP restarts!

We could predict future session cookies... pretty bad!

43

Optional lab: Blackjack! (+5%)

We‘ve put information in „blackjack.login“ in your home directory

Goal: Win $10,000,000 credits! You start off with $10,000

Standard blackjack rules. Grade is min(10, credits / 10M) You get one free refill (delaying inevitable

gambler‘s ruin)

Information and scoreboard: http://hhg.to/blackjack.php

Documents

Computer Security 2014 – Ymir Vigfusson Some slides borrowed from Luis von Ahn‘s 15-251 class @ CMU