GnuTLS servers are able to use tickets issued by each other without access to the secret key as generated by gnutls_session_ticket_key_generate()
. This allows a MITM server without valid credentials to resume sessions with a client that first established an initial connection with a server with valid credentials. The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected.
Because the ticket can be used for resumption without knowledge of the master key I assume (but haven't tested yet) that it can also be used for passive decryption of early data.
I first noticed the issue with Ubuntu version 3.6.13-2ubuntu1, and reproduced it with a build from master
as of52e78f1e.
Steps to Reproduce
gnutls-serv --x509keyfile=authority/server/secret.key --x509certfile=authority/server/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_out session.cache gnutls-serv --x509keyfile=rogueca/mitm/secret.key --x509certfile=rogueca/mitm/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_in session.cache
I've used openssl s_client
to reproduce the problem because gnutls-cli
lacks a way to store resumption data across invocations, but the effect is also reproducible with applications using GnuTLS that cache session data long enough to change the server. I noticed the issue while implementing session resumption for proxy connections in mod_gnutls.
The certificates are just ones out of my test PKI, I can post them if it helps. What matters is that the server from step 1 has a certificate issued by a CA the client trusts, while the server from step 4 has one issued by a CA unknown to the client.
Actual results
The bogus server is able to resume the session, the client does not detect the attack.
Expected results
Session resumption should fail, leading to a full handshake, which must fail unless the second server has valid credentials. A successful full handshake would be the expected result if the server would be restarted with the same certificate instead of a bogus one.
GnuTLS servers are able to use tickets issued by each other without access to the secret key as generated by gnutls_session_ticket_key_generate()
. This allows a MITM server without valid credentials to resume sessions with a client that first established an initial connection with a server with valid credentials. The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected.
Because the ticket can be used for resumption without knowledge of the master key I assume (but haven't tested yet) that it can also be used for passive decryption of early data.
I first noticed the issue with Ubuntu version 3.6.13-2ubuntu1, and reproduced it with a build from master
as of 52e78f1e3a95a6d9e4f1f9a72f6d77102e80f196.
Steps to Reproduce
gnutls-serv --x509keyfile=authority/server/secret.key --x509certfile=authority/server/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_out session.cache gnutls-serv --x509keyfile=rogueca/mitm/secret.key --x509certfile=rogueca/mitm/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_in session.cache
I've used openssl s_client
to reproduce the problem because gnutls-cli
lacks a way to store resumption data across invocations, but the effect is also reproducible with applications using GnuTLS that cache session data long enough to change the server. I noticed the issue while implementing session resumption for proxy connections in mod_gnutls.
The certificates are just ones out of my test PKI, I can post them if it helps. What matters is that the server from step 1 has a certificate issued by a CA the client trusts, while the server from step 4 has one issued by a CA unknown to the client.
Actual results
The bogus server is able to resume the session, the client does not detect the attack.
Expected results
Session resumption should fail, leading to a full handshake, which must fail unless the second server has valid credentials. A successful full handshake would be the expected result if the server would be restarted with the same certificate instead of a bogus one.
以上就是本文的全部内容，希望本文的内容对大家的学习或者工作能带来一定的帮助，也希望大家多多支持 码农网
猜你喜欢:
本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。
Python机器学习基础教程
[德]安德里亚斯·穆勒、[美]莎拉·吉多 / 张亮 / 人民邮电出版社 / 2018-1 / 79.00元
本书是机器学习入门书，以Python语言介绍。主要内容包括：机器学习的基本概念及其应用；实践中最常用的机器学习算法以及这些算法的优缺点；在机器学习中待处理数据的呈现方式的重要性，以及应重点关注数据的哪些方面；模型评估和调参的高级方法，重点讲解交叉验证和网格搜索；管道的概念；如何将前面各章的方法应用到文本数据上，还介绍了一些文本特有的处理方法。一起来看看 《Python机器学习基础教程》 这本书的介绍吧!
