Date: Sat, 15 Sep 2018 16:07:58 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: haskell-tls: Inconsistencies in answers to RSA errors (possiby Bleichenbacher/ROBOT attack) One of the leftovers of our ROBOT/Bleichenbacher research was that we discovered some inconsistencies in haskell-tls, however they only appear in special situations (AES256-CBC modes) and not reliably. I've been asked by the haskell-tls author to report it to the public bug tracker, so I believe it's no longer secret. https://github.com/vincenthz/hs-tls/issues/285 ---------------------- Last year we published research that several TLS implementations were still vulnerable to the classic "Bleichenbacher" attack from 1998 and named it the ROBOT attack . While analyzing several implementations we also figured out inconsistencies with haskell-tls, but as we couldn't really make sense of them we haven't analyzed them in more detail. We observe that in some situations as a response to faulty RSA encryption packages a haskell tls server will answer with an internal server error instead of a bad_record_mac error. The behavior is inconsistent, so we're not sure this can be turned into a practical attack. Yet it's still definitely a bug and potentially a vulnerability. This only happens with ciphers with AES256 and CBC mode. (Which is also why our detection script and many other detection tools that are based on it will not see it, as they often will just test with AES128.) It was originally pointed out to us by Hubert Kario (he's the developer of tls-fuzzer, which will show errors if you run its bleichenbacher check  against a haskell tls server). Another tool that's capable of detecting the error is TLS-Attacker, which is by one of ROBOT's co-authors . A test run would be something like this: java -jar Attacks.jar -loglevel DEBUG bleichenbacher -connect [host] -cipher TLS_RSA_WITH_AES_256_CBC_SHA  https://robotattack.org/  https://github.com/tomato42/tlsfuzzer/blob/master/scripts/test-bleichenbacher-workaround.py  https://github.com/RUB-NDS/TLS-Attacker -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.