{"id":93917,"date":"2020-09-11T01:41:59","date_gmt":"2020-09-10T23:41:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh"},"modified":"2020-09-11T01:41:59","modified_gmt":"2020-09-10T23:41:59","slug":"uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","title":{"rendered":"Zranite\u013enos\u0165 v TLS, ktor\u00e1 umo\u017e\u0148uje ur\u010di\u0165 k\u013e\u00fa\u010d pre pripojenia zalo\u017een\u00e9 na \u0161ifr\u00e1ch DH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zverejnen\u00e9<\/a><\/noindex> inform\u00e1cie o novej zranite\u013enosti<\/a><\/noindex> (CVE-2020-1968) v protokole TLS, s k\u00f3dov\u00fdm menom
\nRaccoon<\/a><\/noindex> a ktor\u00e1 za zriedkav\u00fdch okolnost\u00ed umo\u017e\u0148uje ur\u010di\u0165 predbe\u017en\u00fd prim\u00e1rny k\u013e\u00fa\u010d (pre-master), ktor\u00fd sa d\u00e1 vyu\u017ei\u0165 na de\u0161ifrovanie TLS spojen\u00ed, vr\u00e1tane HTTPS, pri odobrat\u00ed transitn\u00e9ho prenosu (MITM). Je pozorovan\u00e9, \u017ee \u00fatok je ve\u013emi zlo\u017eit\u00fd na praktick\u00fa realiz\u00e1ciu a viac m\u00e1 teoretick\u00fd charakter. Na vykonanie \u00fatoku je potrebn\u00e1 \u0161pecifick\u00e1 konfigur\u00e1cia TLS servera a mo\u017enos\u0165 ve\u013emi presn\u00e9ho merania \u010dasu spracovania oper\u00e1ci\u00ed serverom.<\/p>\n

Probl\u00e9m je priamo v \u0161pecifik\u00e1cii TLS a t\u00fdka sa len pripojen\u00ed, ktor\u00e9 pou\u017e\u00edvaj\u00fa \u0161ifry na z\u00e1klade protokolu v\u00fdmeny k\u013e\u00fa\u010dov DH (Diffie-Hellman, TLS_DH_*). S \u0161iframi ECDH sa probl\u00e9m neprejavuje a zost\u00e1vaj\u00fa bezpe\u010dn\u00e9. Zranite\u013en\u00e9 s\u00fa len protokoly TLS do verzie 1.2 vr\u00e1tane, protokol TLS 1.3 na probl\u00e9m nie je n\u00e1chyln\u00fd. Zranite\u013enos\u0165 sa prejavuje v implement\u00e1ci\u00e1ch TLS, ktor\u00e9 opakovane pou\u017e\u00edvaj\u00fa tajn\u00fd k\u013e\u00fa\u010d DH v r\u00f4znych TLS pripojeniach (podobn\u00e9 spr\u00e1vanie je pozorovan\u00e9 pribli\u017ene na 4.4% serverov z rebr\u00ed\u010dka Alexa Top 1M).<\/p>\n

V OpenSSL 1.0.2e a star\u0161\u00edch verzi\u00e1ch sa prim\u00e1rny k\u013e\u00fa\u010d DH opakovane pou\u017e\u00edva vo v\u0161etk\u00fdch serverov\u00fdch pripojeniach, ak nie je explicitne nastaven\u00e1 mo\u017enos\u0165 SSL_OP_SINGLE_DH_USE. Od OpenSSL 1.0.2f sa prim\u00e1rny k\u013e\u00fa\u010d DH opakovane pou\u017e\u00edva iba pri pou\u017eit\u00ed statick\u00fdch DH-\u0161ifier (\"DH-*\", napr\u00edklad \"DH-RSA-AES256-SHA\"). V OpenSSL 1.1.1 sa zranite\u013enos\u0165 neprejavuje, preto\u017ee v tejto vetve sa prim\u00e1rny k\u013e\u00fa\u010d DH nepou\u017e\u00edva a neaplikuj\u00fa sa statick\u00e9 DH-\u0161ifry. <\/p>\n

Pri pou\u017eit\u00ed met\u00f3dy v\u00fdmeny k\u013e\u00fa\u010dov DH oba strany pripojenia generuj\u00fa n\u00e1hodn\u00e9 uzavret\u00e9 k\u013e\u00fa\u010de (\u010falej k\u013e\u00fa\u010d \"a\" a k\u013e\u00fa\u010d \"b\"), na z\u00e1klade ktor\u00fdch sa vypo\u010d\u00edtavaj\u00fa a posielaj\u00fa otvoren\u00e9 k\u013e\u00fa\u010de (ga mod p a gb mod p). Po prijat\u00ed otvoren\u00fdch k\u013e\u00fa\u010dov ka\u017edou stranou sa vypo\u010d\u00edtava spolo\u010dn\u00fd prim\u00e1rny k\u013e\u00fa\u010d (gab mod p), ktor\u00fd sa pou\u017e\u00edva na formovanie seden\u010dn\u00fdch k\u013e\u00fa\u010dov. \u00datok Raccoon umo\u017e\u0148uje ur\u010di\u0165 prim\u00e1rny k\u013e\u00fa\u010d pomocou anal\u00fdzy inform\u00e1ci\u00ed z ved\u013eaj\u0161\u00edch kan\u00e1lov, vych\u00e1dzaj\u00fac z toho, \u017ee v \u0161pecifik\u00e1ci\u00e1ch TLS a\u017e do verzie 1.2 sa predpisuje vyhadzova\u0165 v\u0161etky po\u010diato\u010dn\u00e9 nulov\u00e9 bajty prim\u00e1rneho k\u013e\u00fa\u010da pred v\u00fdpo\u010dtami s jeho \u00fa\u010das\u0165ou.<\/p>\n

Zah\u0155\u0148a sa skr\u00e1ten\u00fd prim\u00e1rny k\u013e\u00fa\u010d, ktor\u00fd sa pren\u00e1\u0161a do funkcie na generovanie rel\u00e1cie k\u013e\u00fa\u010da, zalo\u017eenej na hashovac\u00edch funkci\u00e1ch s r\u00f4znymi latenciami pri spracovan\u00ed r\u00f4znych \u00fadajov. Presn\u00fdm meran\u00edm \u010dasu oper\u00e1ci\u00ed servera s k\u013e\u00fa\u010dom m\u00f4\u017ee \u00fato\u010dn\u00edk ur\u010di\u0165 n\u00e1povedy (oracle), ktor\u00e9 umo\u017e\u0148uj\u00fa pos\u00fadi\u0165, \u010di prim\u00e1rny k\u013e\u00fa\u010d za\u010d\u00edna nulou alebo nie. Napr\u00edklad \u00fato\u010dn\u00edk m\u00f4\u017ee zachyti\u0165 odoslan\u00fd klientsk\u00fdm zariaden\u00edm otvoren\u00fd k\u013e\u00fa\u010d (ga), znovu ho odosla\u0165 na server a ur\u010di\u0165
\n\u010di za\u010d\u00edna nulou v\u00fdsledn\u00fd prim\u00e1rny k\u013e\u00fa\u010d.<\/p>\n

Samotn\u00e9 ur\u010denie jedn\u00e9ho bajtu k\u013e\u00fa\u010da ni\u010d ned\u00e1va, ale ak \u00fato\u010dn\u00edk zachyt\u00ed odoslan\u00fa pri vyjedn\u00e1van\u00ed pripojenia hodnotu \"ga\", m\u00f4\u017ee formova\u0165 s\u00fabor in\u00fdch hodn\u00f4t s\u00favisiacich s \"ga\" a posla\u0165 ich serveru v samostatn\u00fdch rel\u00e1ci\u00e1ch vyjedn\u00e1vania pripojenia. Formovan\u00edm a posielan\u00edm hodn\u00f4t \"gri*ga\" m\u00f4\u017ee \u00fato\u010dn\u00edk cez anal\u00fdzu zmeny zdr\u017eania v odpovedi servera ur\u010di\u0165 hodnoty, ktor\u00e9 ved\u00fa k obdr\u017eaniu prim\u00e1rnych k\u013e\u00fa\u010dov za\u010d\u00ednaj\u00facich s nulou. Ur\u010den\u00edm tak\u00fdchto hodn\u00f4t m\u00f4\u017ee \u00fato\u010dn\u00edk zostavi\u0165 s\u00fabor rovn\u00edc pre rie\u0161enia<\/a><\/noindex> probl\u00e9my skryt\u00fdch \u010d\u00edsel<\/a><\/noindex> a vypo\u010d\u00edta\u0165 p\u00f4vodn\u00fd prim\u00e1rny k\u013e\u00fa\u010d. <\/p>\n

\"Zranite\u013enos\u0165<\/center><\/p>\n

Vo vulnerability OpenSSL priraden\u00e9<\/a><\/noindex> n\u00edzka \u00farove\u0148 nebezpe\u010denstva, pri\u010dom oprava spo\u010d\u00edvala v presunut\u00ed problematick\u00fdch \u0161ifrovac\u00edch algoritmov «TLS_DH_*» do predvolenej vypnutej kateg\u00f3rie \u0161ifrovac\u00edch algoritmov s nedostato\u010dnou \u00farov\u0148ou ochrany («weak-ssl-ciphers»). Taktie\u017e sa takto zachovali v\u00fdvoj\u00e1ri Mozilly, ktor\u00ed deaktivovali<\/a><\/noindex> v kni\u017enici NSS, pou\u017e\u00edvanej v prehliada\u010di Firefox, s\u00fapravy \u0161ifrov DH a DHE. Od verzie Firefox 78 s\u00fa problematick\u00e9 \u0161ifry vypnut\u00e9. V prehliada\u010di Chrome sa podpora DH zastavila u\u017e v roku 2016. Kni\u017enice BearSSL, BoringSSL, Botan, Mbed TLS a s2n nie s\u00fa ovplyvnen\u00e9, preto\u017ee nepodporuj\u00fa \u0161ifry DH ani statick\u00e9 varianty \u0161ifrov DH. <\/p>\n

Samostatne sa uv\u00e1dzaj\u00fa \u010fal\u0161ie probl\u00e9my (CVE-2020-5929<\/a><\/noindex>) v TLS stacku zariaden\u00ed F5 BIG-IP, ktor\u00e9 robia \u00fatok realistickej\u0161\u00edm. Konkr\u00e9tne boli zisten\u00e9 odch\u00fdlky v spr\u00e1van\u00ed zariaden\u00ed pri pr\u00edtomnosti nulov\u00e9ho bajtu na za\u010diatku prim\u00e1rneho k\u013e\u00fa\u010da, ktor\u00e9 mo\u017eno vyu\u017ei\u0165 namiesto merania presn\u00e9ho \u010dasu latencie pri v\u00fdpo\u010dtoch.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-1968) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 TLS, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Raccoon \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0440\u0435\u0434\u043a\u043e\u043c \u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0438 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 (pre-master), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 TLS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 HTTPS, \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM). \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043e\u0447\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u0430 \u0434\u043b\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u043e\u0441\u0438\u0442 \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93918,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93917","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v TLS, ktor\u00e1 umo\u017e\u0148uje ur\u010di\u0165 k\u013e\u00fa\u010d pre spojenia zalo\u017een\u00e9 na \u0161ifr\u00e1ch DH | ProHoster","description":"Boli zverejnen\u00e9 inform\u00e1cie o novej","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 TLS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0448\u0438\u0444\u0440\u043e\u0432 DH | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-tls-dopuskayushhaya-opredelenie-klyucha-dlya-soedinenij-na-baze-shifrov-dh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-10T23:41:59+00:00","article:modified_time":"2020-09-10T23:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93917","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:37:29","updated":"2022-10-06 06:50:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=93917"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93917\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/93918"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=93917"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=93917"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=93917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}