Executive Summary

Summary
Title Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
Informations
Name VU#306792 First vendor Publication 2018-03-19
Vendor VU-CERT Last vendor Modification 2018-04-04
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#306792

Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions

Original Release date: 19 Mar 2018 | Last revised: 04 Apr 2018

Overview

Bouncy Castle BKS version 1 keystore files use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS-V1 keystore.

Description

Bouncy Castle is a cryptographic library for C# and Java applications, including Android applications. BKS is a keystore format, which is designed to function similarly to a Sun/Oracle JKS keystore. BKS files can contain public keys, including certificates, as well as private keys. BKS files rely on password-based encryption to provide confidentiality and integrity protections to the keystore contents.

The first version of a BKS file contains a design flaw in the determination of the key size used to protect the data inside of the keystore. A SHA-1 hash function, which is 160 bits in length, is used in the BKS HMAC code. In a RFC7292-compliant cryptographic algorithm, the MAC key size is the same size as the hash function being used. This means that the MAC key size should be 160 bits long for BKS files. However, the Bouncy Castle code for version 1 BKS files uses only 16 bits for the MAC key size. This means that regardless of password complexity, a BKS version 1 file can only have 65,536 different encryption keys. A valid password for a keystore can be bruteforced by attempting each of these key values, which can take only seconds.

Update March 21, 2018:
Keystore-level passwords (and associated keys) are used for keystore integrity verification only. Like JKS files, BKS files do not employ container-level encryption. This means that the metadata for BKS file contents is visible without needing to know a password at all. The actual private keys in a BKS file are protected as expected with the password that the author has specified.

Starting with Bouncy Castle 1.47, which was released on March 30, 2012, the BKS keystore format was updated to version 2, which uses a 160-bit MAC. Starting with Bouncy Castle 1.49, optional support for the original keystore format was reintroduced, as "BKS-V1."

Impact

A BKS file that was created with Bouncy Castle 1.46 or earlier, or 1.49 or later as the "BKS-V1" format will have insufficient protection against bruteforce cracking. This may allow an attacker bypass BKS integrity checking.

Solution

Do not rely on version 1 BKS keystore files

BKS version 1 keystore files are not cryptographically sound. A more robust keystore format should be used instead.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Legion of the Bouncy CastleAffected08 Mar 201802 Apr 2018
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base2.1AV:L/AC:L/Au:N/C:N/I:P/A:N
Temporal1.7E:F/RL:OF/RC:C
Environmental1.7CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

  • https://insights.sei.cmu.edu/cert/2018/03/the-curious-case-of-the-bouncy-castle-bks-passwords.html
  • https://www.bouncycastle.org/releasenotes.html
  • https://cryptosense.com/blog/bouncycastle-keystore-security/
  • https://tools.ietf.org/html/rfc7292#appendix-A

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

  • CVE IDs:CVE-2018-5382
  • Date Public:20 Mar 2012
  • Date First Published:19 Mar 2018
  • Date Last Updated:04 Apr 2018
  • Document Revision:19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/306792

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-354 Improper Validation of Integrity Check Value

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 48
Application 1
Application 1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2018-05-22 21:21:33
  • Multiple Updates
2018-04-16 21:21:44
  • Multiple Updates
2018-04-04 21:18:45
  • Multiple Updates
2018-04-03 00:18:46
  • Multiple Updates
2018-03-21 09:18:25
  • Multiple Updates
2018-03-19 13:18:37
  • First insertion