{"id":93917,"date":"2020-09-11T01:41:59","date_gmt":"2020-09-10T23:41:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh"},"modified":"2020-09-11T01:41:59","modified_gmt":"2020-09-10T23:41:59","slug":"uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","title":{"rendered":"Zranitelnost v TLS, kter\u00e1 umo\u017e\u0148uje ur\u010den\u00ed kl\u00ed\u010de pro p\u0159ipojen\u00ed na b\u00e1zi \u0161ifrov\u00e1n\u00ed DH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Odhalen\u00e9<\/a><\/noindex> informace o nov\u00e9m zranitelnosti<\/a><\/noindex> (CVE-2020-1968) v protokolu TLS, kter\u00fd byl ozna\u010den k\u00f3dov\u00fdm n\u00e1zvem
\nRaccoon<\/a><\/noindex> a v d\u016fsledku vz\u00e1cn\u00fdch okolnost\u00ed umo\u017e\u0148uje ur\u010dit p\u0159edb\u011b\u017en\u00fd prim\u00e1rn\u00ed kl\u00ed\u010d (pre-master), kter\u00fd lze vyu\u017e\u00edt k de\u0161ifrov\u00e1n\u00ed TLS spojen\u00ed, v\u010detn\u011b HTTPS, p\u0159i zachycen\u00ed p\u0159echodn\u00e9ho provozu (MITM). Je t\u0159eba poznamenat, \u017ee \u00fatok je velmi slo\u017eit\u00fd na praktickou realizaci a m\u00e1 sp\u00ed\u0161e teoretick\u00fd charakter. K proveden\u00ed \u00fatoku je zapot\u0159eb\u00ed specifick\u00e1 konfigurace TLS serveru a mo\u017enost velmi p\u0159esn\u00e9ho m\u011b\u0159en\u00ed doby zpracov\u00e1n\u00ed operac\u00ed serverem.<\/p>\n

Probl\u00e9m spo\u010d\u00edv\u00e1 p\u0159\u00edmo ve specifikaci TLS a t\u00fdk\u00e1 se pouze spojen\u00ed, kter\u00e1 pou\u017e\u00edvaj\u00ed \u0161ifry zalo\u017een\u00e9 na protokolu v\u00fdm\u011bny kl\u00ed\u010d\u016f DH (Diffie-Hellman, TLS_DH_*). U \u0161ifer ECDH se probl\u00e9m nevyskytuje a z\u016fst\u00e1vaj\u00ed bezpe\u010dn\u00e9. Zraniteln\u00e9 jsou pouze protokoly TLS a\u017e do verze 1.2 v\u010detn\u011b; protokol TLS 1.3 nen\u00ed touto problematikou posti\u017een. Zranitelnost se projevuje v implementac\u00edch TLS, kter\u00e9 opakovan\u011b pou\u017e\u00edvaj\u00ed tajn\u00fd kl\u00ed\u010d DH v r\u016fzn\u00fdch TLS spojen\u00edch (takov\u00e9 chov\u00e1n\u00ed se objevuje p\u0159ibli\u017en\u011b na 4.4 % server\u016f v \u017eeb\u0159\u00ed\u010dku Alexa Top 1M).<\/p>\n

Ve verz\u00edch OpenSSL 1.0.2e a star\u0161\u00edch je prim\u00e1rn\u00ed kl\u00ed\u010d DH opakovan\u011b pou\u017e\u00edv\u00e1n ve v\u0161ech serverov\u00fdch spojen\u00edch, pokud nen\u00ed v\u00fdslovn\u011b nastavena volba SSL_OP_SINGLE_DH_USE. Od verze OpenSSL 1.0.2f je prim\u00e1rn\u00ed kl\u00ed\u010d DH opakovan\u011b pou\u017e\u00edv\u00e1n pouze p\u0159i pou\u017eit\u00ed statick\u00fdch DH \u0161ifer (\"DH-*, nap\u0159\u00edklad \"DH-RSA-AES256-SHA\"). Ve verzi OpenSSL 1.1.1 se zranitelnost neprojevuje, proto\u017ee v t\u00e9to v\u011btvi se nepraktikuje prim\u00e1rn\u00ed kl\u00ed\u010d DH a nejsou pou\u017e\u00edv\u00e1ny statick\u00e9 DH \u0161ifry. <\/p>\n

P\u0159i pou\u017eit\u00ed metody v\u00fdm\u011bny kl\u00ed\u010d\u016f DH ob\u011b strany spojen\u00ed generuj\u00ed n\u00e1hodn\u00e9 soukrom\u00e9 kl\u00ed\u010de (d\u00e1le kl\u00ed\u010d \"a\" a kl\u00ed\u010d \"b\"), na jejich\u017e z\u00e1klad\u011b se vypo\u010d\u00edt\u00e1vaj\u00ed a odes\u00edlaj\u00ed ve\u0159ejn\u00e9 kl\u00ed\u010de (ga mod p a gb mod p). Po obdr\u017een\u00ed ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f ka\u017edou stranou se vypo\u010d\u00edt\u00e1v\u00e1 spole\u010dn\u00fd prim\u00e1rn\u00ed kl\u00ed\u010d (gab mod p), kter\u00fd se pou\u017e\u00edv\u00e1 pro formov\u00e1n\u00ed relace kl\u00ed\u010d\u016f. \u00datok Raccoon umo\u017e\u0148uje ur\u010dit prim\u00e1rn\u00ed kl\u00ed\u010d anal\u00fdzou informac\u00ed z vedlej\u0161\u00edch kan\u00e1l\u016f, vych\u00e1zej\u00edc\u00ed z toho, \u017ee ve specifikac\u00edch TLS a\u017e do verze 1.2 se p\u0159edpokl\u00e1d\u00e1, \u017ee se odstran\u00ed v\u0161echny po\u010d\u00e1te\u010dn\u00ed nulov\u00e9 byty prim\u00e1rn\u00edho kl\u00ed\u010de p\u0159ed v\u00fdpo\u010dty zahrnuj\u00edc\u00edmi tento kl\u00ed\u010d.<\/p>\n

V\u010detn\u011b zkr\u00e1cen\u00e9ho prim\u00e1rn\u00edho kl\u00ed\u010de je p\u0159ed\u00e1v\u00e1n funkci generace relace zalo\u017een\u00e9 na hash funkc\u00edch, kter\u00e9 maj\u00ed odli\u0161n\u00e9 latence p\u0159i zpracov\u00e1n\u00ed r\u016fzn\u00fdch dat. P\u0159esn\u00e9 m\u011b\u0159en\u00ed \u010dasu operac\u00ed serveru s kl\u00ed\u010dem umo\u017e\u0148uje \u00fato\u010dn\u00edkovi ur\u010dit n\u00e1znaky (oracle), kter\u00e9 d\u00e1vaj\u00ed mo\u017enost posoudit, zda prim\u00e1rn\u00ed kl\u00ed\u010d za\u010d\u00edn\u00e1 nulou \u010di nikoli. Nap\u0159\u00edklad \u00fato\u010dn\u00edk m\u016f\u017ee zachytit ve\u0159ejn\u00fd kl\u00ed\u010d (ga), kter\u00fd klient odeslal, znovu jej odeslat na server a zjistit
\nzda v\u00fdsledn\u00fd prim\u00e1rn\u00ed kl\u00ed\u010d za\u010d\u00edn\u00e1 nulou.<\/p>\n

Samo o sob\u011b ur\u010den\u00ed jednoho bytu kl\u00ed\u010de nic ned\u00e1v\u00e1, ale pokud \u00fato\u010dn\u00edk zachyt\u00ed p\u0159i vyjedn\u00e1v\u00e1n\u00ed spojen\u00ed klientem hodnotu \"ga\", m\u016f\u017ee sestavit sadu dal\u0161\u00edch hodnot spojen\u00fdch s \"ga\" a odeslat je na server v samostatn\u00fdch relac\u00edch vyjedn\u00e1v\u00e1n\u00ed spojen\u00ed. Tvo\u0159en\u00edm a odes\u00edl\u00e1n\u00edm hodnot \"gri*ga\" m\u016f\u017ee \u00fato\u010dn\u00edk prost\u0159ednictv\u00edm anal\u00fdzy zm\u011bny latence v odpov\u011bdi serveru ur\u010dit hodnoty, kter\u00e9 vedou k prim\u00e1rn\u00edm kl\u00ed\u010d\u016fm za\u010d\u00ednaj\u00edc\u00edm na nulu. Ur\u010den\u00edm takov\u00fdch hodnot m\u016f\u017ee \u00fato\u010dn\u00edk sestavit sadu rovnic pro \u0159e\u0161en\u00ed<\/a><\/noindex> probl\u00e9mu skryt\u00fdch \u010d\u00edsel<\/a><\/noindex> a vypo\u010d\u00edtat po\u010d\u00e1te\u010dn\u00ed prim\u00e1rn\u00ed kl\u00ed\u010d. <\/p>\n

\"Zranitelnost<\/center><\/p>\n

Ve OpenSSL jsou zranitelnosti byla p\u0159id\u011blena<\/a><\/noindex> n\u00edzk\u00e1 \u00farove\u0148 nebezpe\u010d\u00ed, a oprava spo\u010d\u00edvala v p\u0159esunut\u00ed problematick\u00fdch \u0161ifer «TLS_DH_*» do kategorii \u0161ifer s nedostate\u010dnou \u00farovn\u00ed zabezpe\u010den\u00ed, kter\u00e1 je ve v\u00fdchoz\u00edm nastaven\u00ed vypnuta («weak-ssl-ciphers»). Stejn\u011b postupovali v\u00fdvoj\u00e1\u0159i Mozilla, kte\u0159\u00ed vypnuli<\/a><\/noindex> v knihovn\u011b NSS pou\u017e\u00edvan\u00e9 ve Firefoxu sady \u0161ifrov\u00e1n\u00ed DH a DHE. Od Firefoxu 78 byly problematick\u00e9 \u0161ifry vypnuty. V Chrome byla podpora DH ukon\u010dena ji\u017e v roce 2016. Knihovny BearSSL, BoringSSL, Botan, Mbed TLS a s2n nejsou touto problematikou posti\u017eeny, proto\u017ee nepodporuj\u00ed \u0161ifry DH nebo statick\u00e9 varianty DH \u0161ifr\u016f. <\/p>\n

D\u00e1le je t\u0159eba vyzdvihnout dal\u0161\u00ed probl\u00e9my (CVE-2020-5929<\/a><\/noindex>) ve TLS stacku za\u0159\u00edzen\u00ed F5 BIG-IP, kter\u00e9 \u010din\u00ed \u00fatok v\u00edce realistick\u00fd. Zejm\u00e9na byly zji\u0161t\u011bny odchylky v chov\u00e1n\u00ed za\u0159\u00edzen\u00ed p\u0159i p\u0159\u00edtomnosti nulov\u00e9ho bajtu na za\u010d\u00e1tku prim\u00e1rn\u00edho kl\u00ed\u010de, kter\u00e9 lze pou\u017e\u00edt m\u00edsto m\u011b\u0159en\u00ed p\u0159esn\u00e9ho \u010dasu latence b\u011bhem v\u00fdpo\u010dt\u016f.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-1968) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 TLS, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Raccoon \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0440\u0435\u0434\u043a\u043e\u043c \u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0438 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 (pre-master), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 TLS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 HTTPS, \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM). \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043e\u0447\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u0430 \u0434\u043b\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u043e\u0441\u0438\u0442 \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93918,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93917","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v TLS, kter\u00e1 umo\u017e\u0148uje ur\u010den\u00ed kl\u00ed\u010de pro spojen\u00ed zalo\u017een\u00e9 na \u0161ifrech DH | ProHoster","description":"Byly odhaleny informace o nov\u00e9","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 TLS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0448\u0438\u0444\u0440\u043e\u0432 DH | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-10T23:41:59+00:00","article:modified_time":"2020-09-10T23:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93917","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:37:29","updated":"2022-10-06 06:50:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/93917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=93917"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/93917\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/93918"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=93917"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=93917"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=93917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}