A team of researchers from the University of California, San Diego has demonstrated the ability to recreate the private RSA host keys of an SSH server using passive analysis of SSH traffic. An attack can be carried out on servers on which, due to a combination of circumstances or actions of the attacker, failures occur during the calculation of the digital signature when establishing an SSH connection. Failures can be either software (incorrect execution of mathematical operations, memory corruption) or hardware (errors in the operation of NVRAM and DRAM or failures during power outages).
One of the options for stimulating failures could be RowHammer attacks, which, among other things, allow remotely or when processing JavaScript code in a browser to achieve distortion of the contents of individual bits of memory during intensive cyclic reading of data from neighboring memory cells. Another option for causing failures could be the exploitation of vulnerabilities that lead to buffer overflows and corruption of data with keys in memory.
The published study shows that when digital signatures based on the RSA algorithm are used in SSH, attacks to recreate RSA private keys using the Lattice method (Fault Attack) are applicable to the digital signature parameters in the event of software or hardware failures during the signature calculation process. The essence of the method is that by comparing correct and faulty RSA digital signatures, you can determine the greatest common divisor to output one of the prime numbers used to generate the key.
RSA encryption is based on the operation of exponentiation of a large number. The public key contains the modulus and degree. The module is formed based on two random prime numbers, which are known only to the owner of the private key. The attack can be applied to RSA implementations using the Chinese Remainder Theorem and deterministic padding schemes such as PKCS#1 v1.5.
To carry out the attack, it's enough to passively monitor legitimate connections to the SSH server until a faulty digital signature is detected in the traffic, which can be used as a source of information to reconstruct the private RSA key. After reconstructing the host RSA key, the attacker can, during a man-in-the-middle attack, surreptitiously redirect requests to a fake host posing as a compromised SSH server and intercept the traffic transmitted to it. server data.
By examining a collection of intercepted network data that included approximately 5.2 billion records associated with the use of the SSH protocol, the researchers identified approximately 3.2 billion public host keys and digital signatures used during SSH session negotiation. Of these, 1.2 billion (39.1%) were generated using the RSA algorithm. In 593671 cases (0.048%) the RSA signature was damaged and could not be verified. For 4962 failed signatures, we were able to use the Lattice factorization method to determine the private key from the known public key, resulting in the reconstruction of 189 unique RSA key pairs (in many cases, the same keys and failed devices were used to generate different damaged signatures). It took about 26 hours of CPU time to recreate the keys.
The problem only affects specific implementations of the SSH protocol, used primarily on embedded devices. Examples of devices with problematic SSH implementations include products from Zyxel, Cisco, Mocana and Hillstone Networks. OpenSSH is not affected by this problem because it uses the OpenSSL (or LibreSSL) library to generate keys, which has been protected against Fault Attacks since 2001. Moreover, in OpenSSH, the ssh-rsa digital signature scheme (based on sha1) has been deprecated since 2020 and disabled in version 8.8 (support for the rsa-sha2-256 and rsa-sha2-512 schemes remains). The attack could potentially be applicable to the IPsec protocol, but the researchers did not have sufficient experimental data to confirm such an attack in practice.
Source: opennet.ru
