Vulnerability Note VU#536044

OpenSSL leaks ECDSA private key through a remote timing attack

Overview

The OpenSSL ladder implementation for scalar multiplication of points on elliptic curves over binary fields is susceptible to a timing attack vulnerability. This vulnerability can be used to steal the private key of a TLS server that authenticates with ECDSA signatures and binary curves.

I. Description

Billy Bob Brumley's and Nicola Tuveri's paper "Remote Timing Attacks are Still Practical" states:

"For over two decades, timing attacks have been an active area of research within applied cryptography. These attacks exploit cryptosystem or protocol implementations that do not run in constant time. When implementing an elliptic curve cryptosystem that provides side-channel resistance, the scalar multiplication routine is a critical component. In such instances, one attractive method often suggested in the literature is Montgomery’s ladder that performs a fixed sequence of curve and field operations.

This paper describes a timing attack vulnerability in OpenSSL's ladder implementation for curves over binary fields. We use this vulnerability to steal the private key of a TLS server where the server authenticates with ECDSA signatures. Using the timing of the exchanged messages, the messages themselves, and the signatures, we mount a lattice attack that recovers the private key."

II. Impact

A remote attacker can retrieve the private key of a TLS server that authenticates with ECDSA signatures and binary curves.

III. Solution

We are currently unaware of a practical solution to this problem.

Do not use ECDSA signatures and binary curves for authentication.

Vendor Information

Vendor	Status	Date Notified	Date Updated
Apache-SSL	Unknown	2011-04-21	2011-04-21
Apple Inc.	Unknown	2011-05-10	2011-05-10
CentOS	Unknown	2011-05-10	2011-05-10
Debian GNU/Linux	Unknown	2011-05-10	2011-05-10
FreeBSD Project	Unknown	2011-05-10	2011-05-10
Gentoo Linux	Unknown	2011-05-10	2011-05-10
Mandriva S. A.	Unknown	2011-05-10	2011-05-10
NetBSD	Unknown	2011-05-10	2011-05-10
OpenSSL	Affected	2011-03-29	2011-05-11
Red Hat, Inc.	Unknown	2011-05-10	2011-05-10
Slackware Linux Inc.	Unknown	2011-05-10	2011-05-10
SUSE Linux	Unknown	2011-05-10	2011-05-10
Ubuntu	Unknown	2011-05-10	2011-05-10

References

http://www.openssl.org/docs/crypto/ecdsa.html
http://eprint.iacr.org/2011/232

Credit

Thanks to Billy Brumley for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

Date Public:	2011-05-17
Date First Published:	2011-05-17
Date Last Updated:	2011-06-01
CERT Advisory:
CVE-ID(s):	CVE-2011-1945
NVD-ID(s):	CVE-2011-1945
US-CERT Technical Alerts:
Severity Metric:	0.13
Document Revision:	13