TLS Attacks

Question 1

Replay attack

Answer 1

attacker just replays messages he previously observed. He can’t decrypt these messages, but they mean something to the server. use nonces generated by server/leg.client to counter replay attacks.

Question 2

explain FREAK attack

Answer 2

active MitM client/server connection

1. change client hello message to contain the RSA_EXPORT cipher.
2. faulty server responds with 512 bit RSA value (easy to break)
3. attacker changes server_hello back to reflect client_hello
4. faulty client accepts 512 bit RSA value although he did not request RSA_EXPORT
5. client sends pms encrypted with 512 bit RSA
6. attacker decrypts message with precomputed priv key for RSA value and gets pms
7. server sends ServerFinished and attacker alters it to reflect the clients view of the handshake (easy having pms)
8. client sends ClientFinished and attacker alters it to reflect the servers view of the handshake (easy having pms)

Question 3

explain Heartbleed attack

Answer 3

exploits heartbeat messages used to keep connection open:
client sends “sheep” and buffer_length=5 to server and expects a message “sheep” back. if buffer_length is longer than message, the server sends some of its memory, might be sensitive data
attacker sends: “sheep” and buffer_length=2000
client authentication does not help, because heartbeat messages can be send during handshake, before client would be auth.

Question 4

explain replay attack with two servers hosting the same service (with 0-RTT)

Answer 4

1. client connects to server A (full handshake)
2. client issues another request. 0-RTT is used
3. attacker blocks response from A.
4. attacker replays 0-RTT request to server B and lets Bs response through
5. client will retry the request using the full handshake with B
   - -> client has issued the same request twice

Question 5

0-RTT protocol and problems

Answer 5

1. client sends PSK and application data encrypted with this key (optional DH value for later forward sec)
2. server Finished
3. Client finished
   ISSUE:
   - vulnerable to replay attacks: server is not authenticated in first message (especially in distributed server environments)
   - no forward security

Question 6

1-RTT protocol

Answer 6

client guesses which DH group server supports and just sends that value.

Question 7

Attacks/problems on/with RC4

Answer 7

the first 256 bits of the keystream in RC4 are biased. wiht enough ciphertexts the attacker can recover the planetext
–>solution: drop first 256 bits of keystream