DOCSLIB.ORG

HSM SECURITY Securing PKCS#11 Interfaces

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
HSM SECURITY Securing PKCS#11 Interfaces HSM SECURITY Securing PKCS#11 Interfaces Whitepaper v1.9 August 2019 Cryptosense | HSM Security Whitepaper 2 Contents 1. Introduction 3 2. Brief History of PKCS#11 3 3. Overview of PKCS#11 Design 3 4. Threat Scenario and Security Properties for PKCS#11 4 5. Attacking PKCS#11 HSM Security 5 5.1. Memory corruption attacks 5 5.2. Non-compliant PKCS#11 Implementations 6 5.3. Errors in Crypto Implementation 7 5.4. Attacks on Compliant PKCS#11 Implementations 7 6. Errors in Using the HSM 9 6.1. Insecure Crypto Mechanisms 10 6.2. Misuse of Crypto 10 6.3. Key Management Failures 10 7. Summary 10 8. About Cryptosense 11 9. Bibliography 11 This document is protected by copyright. No part of the document may be reproduced or redistributed in any form by any means without the prior written authorization of Cryptosense. This document is provided “as is" without any warranty of any kind. Cryptosense SA cannot be held responsible for any misconduct or malicious use of this document by a third party or damage caused by any information this document contains. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Cryptosense SA, 231 Rue Saint-Honoré, 75001 Paris France cryptosense.com © Cryptosense 2019 Cryptosense | HSM Security Whitepaper 3 1. Introduction Modern applications that use cryptography usually access that functionality via an application program interface (API) to a software or hardware cryptographic provider. Security-critical applications often make use of Hardware Security Modules (HSMs): special purpose computers that provide high-speed cryptographic services whilst keeping key material inside a tamper- sensitive enclosure. Together with smart cards or similar chip-based tokens, they form the backbone of many modern cryptographic applications in diverse sectors from banking to automotive. HSMs and smart cards typically undergo a security certification procedure such as FIPS 140 or Common Criteria that examines tamper resistance and susceptibility to side channel attacks amongst other things. However, neither examines the security of the interface of the device. In fact, it would be hard to categorically state that the interface is secure, since each user will typically choose different configuration options that may affect security, and use of the interface by applications must also be taken into account. The most commonly used API standard is RSA PKCS#11 [3], also known as Cryptoki. Following convention we will refer to PKCS#11 to mean the API itself rather than the document that defines it. While PKCS#11 has important benefits for interoperability since it is so widely supported, it is a large and open standard supporting a wide range of use cases. This makes it extremely tricky to implement correctly, and difficult to configure and use in a secure way. In this white paper, we discuss attacks on systems using the PKCS#11 API. We consider what it means for an interface to be secure, and we discuss how to audit applications’ use of the API. There will be plenty of concrete examples of attacks on real devices, and we will explain how to detect these issues using Cryptosense Analyzer Platform. 2. Brief History of PKCS#11 The Public Key Cryptography Standards (PKCS) were proposed by RSA Inc, the company set up to commercialise the patent on the RSA encryption and signature algorithms. The first standard in the series, PKCS#1, describes the required mathematical properties of RSA keys, how to perform RSA encryption, decryption, signing, and verification using a standard padding format etc. Further standards described password-based cryptography, various aspects of Public Key Infrastructure, Diffie-Hellman Key Agreement. Many of the PKCS have been abandoned or fallen out of use, but PKCS#11, the standard that defines the Cryptoki interface for cryptographic hardware, was handed over to the OASIS PKCS#11 Technical Committee in 2012, who continue to revise and develop it. The first version (v1.0) of PKCS#11 was published in 1995. The current version is 2.40, released in 2015. Version 3.0 is in preparation. 3. Overview of PKCS#11 Design RSA PKCS#11 describes its API in just under 400 pages [3]. Here we give just a brief description to enable understanding of the various families of vulnerabilities. © Cryptosense 2019 Cryptosense | HSM Security Whitepaper 4 The API is stateful, maintaining in particular session state, operation state for e.g. encryption of large chunks of data, and information about cryptographic objects. In a PKCS#11-based API, applications initiate a session with the cryptographic token, by supplying a PIN. Once a session is initiated, the application may access the objects stored on the token, such as keys and certificates. Objects are referenced in the API via handles, which can be thought of as pointers to or names for the objects. Objects have attributes, which may be e.g. the value of a key, or metadata giving properties of the object, e.g. whether the key may be used for encryption, or for encrypting other keys. New objects can be created by calling a key generation command, or by ‘unwrapping’ an encrypted key packet. In both cases a fresh handle is returned. When a function in the token’s API is called with a reference to a particular object, the token first checks that the attributes of the object allow it to be used for that function. For example, if the encrypt function is called with the handle for a particular key, that key must have the CKA_ ENCRYPT encrypt attribute set to true. To protect a key from being revealed, the attribute CKA_SENSITIVE can be set to true. This means that requests to view the object’s key value via the API will result in an error message. Further protection can be given to a key by setting the CKA_EXTRACTABLE attribute to false. In this case, even a request to wrap the key, i.e. export it from the device encrypted, will be refused. 4. Threat Scenario and Security Properties for PKCS#11 The API between applications and cryptographic services is a natural trust boundary. We would expect a well-designed interface to maintain some security properties even if the application becomes compromised. This is indeed what PKCS#11 aims to do, as stated (in a rather roundabout way) in the Security Considerations section of the standard [9]: As an interface to cryptographic devices, Cryptoki provides a basis for security in a computer or communications system. Two of the particular features of the interface that facilitate such security are the following: 1. “Access to private objects on the token, and possibly to cryptographic functions and/or certificates on the token as well, requires a PIN. Thus, possessing the cryptographic device that implements the token may not be sufficient to use it; the PIN may also be needed. 2. Additional protection can be given to private keys and secret keys by marking them as “sensitive” or “unextractable”. Sensitive keys cannot be revealed in plaintext off the token, and unextractable keys cannot be revealed off the token even when encrypted (though they can still be used as keys).” In PKCS#11, the PIN required to open a session on the cryptographic device is passed directly from the application to the device, hence if the application is compromised, the PIN will typically be compromised as well, as the standard notes: “While the token itself may be secure, one must also consider the security of the operating system by which the application interfaces to it, especially since the PIN may be passed through the operating system. This can make it easy for a rogue application on the operating system to obtain the PIN; it is also possible that other devices monitoring communication lines to the © Cryptosense 2019 Cryptosense | HSM Security Whitepaper 5 cryptographic device can obtain the PIN. Rogue applications and devices may also change the commands sent to the cryptographic device to obtain services other than what the application requested. [..] “We note that none of the attacks just described can compromise keys marked “sensitive”, since a key that is sensitive will always remain sensitive. Similarly, a key that is unextractable cannot be modified to be extractable.” Real-world instances of attacks where the intruder has obtained direct access to the HSM API include the RBS Worldpay compromise [1] and DigiNotar breach [2]. To summarise, the aim of the PKCS#11 API is to protect SENSITIVE and UNEXTRACTABLE keys on the device no matter whether the PIN has been intercepted and the application compromised so that it can send any sequence of PKCS#11 calls to the interface. In the rest of this whitepaper, we will concentrate on attacks on precisely these properties. 5. Attacking PKCS#11 HSM Security We have established a threat scenario where an attacker has full access to the PKCS#11 API using legitimate user credentials, and an objective to obtain the values of the “sensitive” and “unextractable” keys inside. Below we discuss the various ways this can be achieved. 5.1. Memory corruption attacks The first thing to note is that PKCS#11 describes a large low-level C API, with buffers, pointers, Type-Length-Value lists, etc., all of which must be carefully managed to avoid buffer overruns or other memory corruption based attacks. Like any large and complex system of this nature, bugs are quite common in practice. Sometimes, partial input sanitisation takes place in the PKCS#11 driver on the client machine rather than in the HSM itself, meaning that an attacker can bypass the checks to force invalid calls into the HSM and trigger a memory management error.
Load more

Recommended publications
  • Key Derivation Functions and Their GPU Implementation
    MASARYK UNIVERSITY FACULTY}w¡¢£¤¥¦§¨ OF I !"#$%&'()+,-./012345<yA|NFORMATICS Key derivation functions and their GPU implementation BACHELOR’S THESIS Ondrej Mosnáˇcek Brno, Spring 2015 This work is licensed under a Creative Commons Attribution- NonCommercial-ShareAlike 4.0 International License. https://creativecommons.org/licenses/by-nc-sa/4.0/ cbna ii Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Ondrej Mosnáˇcek Advisor: Ing. Milan Brož iii Acknowledgement I would like to thank my supervisor for his guidance and support, and also for his extensive contributions to the Cryptsetup open- source project. Next, I would like to thank my family for their support and pa- tience and also to my friends who were falling behind schedule just like me and thus helped me not to panic. Last but not least, access to computing and storage facilities owned by parties and projects contributing to the National Grid In- frastructure MetaCentrum, provided under the programme “Projects of Large Infrastructure for Research, Development, and Innovations” (LM2010005), is also greatly appreciated. v Abstract Key derivation functions are a key element of many cryptographic applications. Password-based key derivation functions are designed specifically to derive cryptographic keys from low-entropy sources (such as passwords or passphrases) and to counter brute-force and dictionary attacks. However, the most widely adopted standard for password-based key derivation, PBKDF2, as implemented in most applications, is highly susceptible to attacks using Graphics Process- ing Units (GPUs).
    [Show full text]
  • Public Key Cryptography Public Key Cryptography
    Public Key Cryptography Public Key Cryptography • Symmetric Key: – Same key used for encryption and decrypiton – Same key used for message integrity and validation • Public-Key Cryptography – Use one key to encrypt or sign messages – Use another key to decrypt or validate messages • Keys – Public key known to the world and used to send you a message – Only your private key can decrypt the message Public Key Private Key Plaintext Ciphertext Plaintext Encryption Decryption ENTS 689i | Network Immunity | Fall 2008 Lecture 2 Public Key Cryptography • Motivations – In symmetric key cryptography, a key was needed between every pair of users wishing to securely communicate • O(n2) keys – Problem of establishing a key with remote person with whom you wish to communicate • Advantages to Public Key Cryptography – Key distribution much easier: everyone can known your public key as long as your private key remains secret – Fewer keys needed • O(n) keys • Disadvantages – Slow, often up to 1000x slower than symmetric-key cryptography ENTS 689i | Network Immunity | Fall 2008 Lecture 2 Cryptography and Complexity • Three classes of complexity: – P: solvable in polynomial time, O(nc) – NP: nondeterministic solutions in polynomial time, deterministic solutions in exponential time – EXP: exponential solutions, O(cn) • Cryptographic problems should be: increasing P – Encryption should be P difficult – Decryption should be P with key NP – Decryption should be NP for attacker EXP • Need problems where complexity of solution depends on knowledge of a key ENTS
    [Show full text]
  • The Double Ratchet Algorithm
    The Double Ratchet Algorithm Trevor Perrin (editor) Moxie Marlinspike Revision 1, 2016-11-20 Contents 1. Introduction 3 2. Overview 3 2.1. KDF chains . 3 2.2. Symmetric-key ratchet . 5 2.3. Diffie-Hellman ratchet . 6 2.4. Double Ratchet . 13 2.6. Out-of-order messages . 17 3. Double Ratchet 18 3.1. External functions . 18 3.2. State variables . 19 3.3. Initialization . 19 3.4. Encrypting messages . 20 3.5. Decrypting messages . 20 4. Double Ratchet with header encryption 22 4.1. Overview . 22 4.2. External functions . 26 4.3. State variables . 26 4.4. Initialization . 26 4.5. Encrypting messages . 27 4.6. Decrypting messages . 28 5. Implementation considerations 29 5.1. Integration with X3DH . 29 5.2. Recommended cryptographic algorithms . 30 6. Security considerations 31 6.1. Secure deletion . 31 6.2. Recovery from compromise . 31 6.3. Cryptanalysis and ratchet public keys . 31 1 6.4. Deletion of skipped message keys . 32 6.5. Deferring new ratchet key generation . 32 6.6. Truncating authentication tags . 32 6.7. Implementation fingerprinting . 32 7. IPR 33 8. Acknowledgements 33 9. References 33 2 1. Introduction The Double Ratchet algorithm is used by two parties to exchange encrypted messages based on a shared secret key. Typically the parties will use some key agreement protocol (such as X3DH [1]) to agree on the shared secret key. Following this, the parties will use the Double Ratchet to send and receive encrypted messages. The parties derive new keys for every Double Ratchet message so that earlier keys cannot be calculated from later ones.
    [Show full text]
  • On the Security of the PKCS#1 V1.5 Signature Scheme
    On the Security of the PKCS#1 v1.5 Signature Scheme Tibor Jager1 Saqib A. Kakvi1 Alexander May2 September 10, 2018 1Department of Computer Science, Universitat¨ Paderborn ftibor.jager,[email protected] 2Hortz Gortz¨ Institute, Ruhr Universitat¨ Bochum [email protected] Abstract The RSA PKCS#1 v1.5 signature algorithm is the most widely used digital signature scheme in practice. Its two main strengths are its extreme simplicity, which makes it very easy to implement, and that verification of signatures is significantly faster than for DSA or ECDSA. Despite the huge practical importance of RSA PKCS#1 v1.5 signatures, providing formal evidence for their security based on plausible cryptographic hardness assumptions has turned out to be very difficult. Therefore the most recent version of PKCS#1 (RFC 8017) even recommends a replacement the more complex and less efficient scheme RSA-PSS, as it is provably secure and therefore considered more robust. The main obstacle is that RSA PKCS#1 v1.5 signatures use a deterministic padding scheme, which makes standard proof techniques not applicable. We introduce a new technique that enables the first security proof for RSA-PKCS#1 v1.5 signatures. We prove full existential unforgeability against adaptive chosen-message attacks (EUF-CMA) under the standard RSA assumption. Furthermore, we give a tight proof under the Phi-Hiding assumption. These proofs are in the random oracle model and the parameters deviate slightly from the standard use, because we require a larger output length of the hash function. However, we also show how RSA-PKCS#1 v1.5 signatures can be instantiated in practice such that our security proofs apply.
    [Show full text]
  • PKCS #15— a Cryptographic-Token Information Format Standard
    THE ADVANCED COMPUTING SYSTEMS ASSOCIATION The following paper was originally published in the USENIX Workshop on Smartcard Technology Chicago, Illinois, USA, May 10–11, 1999 PKCS #15— A Cryptographic-Token Information Format Standard Magnus Nyström RSA Laboratories © 1999 by The USENIX Association All Rights Reserved Rights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein. For more information about the USENIX Association: Phone: 1 510 528 8649 FAX: 1 510 548 5738 Email: [email protected] WWW: http://www.usenix.org PKCS #15 – A Cryptographic Token Information Format Standard Magnus Nyström RSA Laboratories, Bedford MA 01730, USA E-mail: [email protected] acceptance and use of them both by application Abstract developers and by consumers will be muted. We identify the need for a portable format for storage of To optimize the benefit to both the industry and end- user credentials (certificates, keys) on cryptographic users, it is important that solutions to these issues be tokens such as integrated circuit cards (IC cards). Given developed in a manner that supports a variety of this need, a recent proposal in the area, RSA operating environments, application programming Laboratories' PKCS #15 is described and compared with interfaces, and a broad base of applications. Only previous and related work. through this approach can the needs of constituencies be supported and the development of credentials-activated applications encouraged, as a cost-effective solution to 1 Background and Motivation meeting requirements in a very diverse set of markets.
    [Show full text]
  • Introduction to Public Key Infrastructures
    Introduction to Public Key Infrastructures Johannes A. Buchmann • Evangelos Karatsiolis Alexander Wiesmaier Introduction to Public Key Infrastructures 123 Johannes A. Buchmann Evangelos Karatsiolis FB Informatik FlexSecure GmbH TU Darmstadt Darmstadt Darmstadt Germany Germany Alexander Wiesmaier AGT International Darmstadt Germany ISBN 978-3-642-40656-0 ISBN 978-3-642-40657-7 (eBook) DOI 10.1007/978-3-642-40657-7 Springer Heidelberg New York Dordrecht London Library of Congress Control Number: 2013954524 © Springer-Verlag Berlin Heidelberg 2013 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location, in its current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
    [Show full text]
  • Analysis of Key Management in Matrix
    Bachelor thesis Computing Science Radboud University Analysis of key management in Matrix Author: First supervisor/assessor: Floris Hendriks Prof. J.J.C. Daemen s4749294 [email protected] Second supervisor: Dr. B.J.M. Mennink [email protected] Second assessor: Dr. C.E. Dobraunig [email protected] January 17, 2020 Abstract This thesis presents an analysis of Matrix’s key management. Matrix is an end-to-end encrypted and decentralised application layer proto- col, developed by The Matrix.org Foundation C.I.C. The protocol is used, among other applications, to end-to-end encrypt messages in a decen- tralised chat system. To date, Matrix is not equipped with a clear and well-described overview on how keys enable end-to-end encryption in a decentralised network. This thesis therefore describes how keys in Ma- trix are established, used, stored, exchanged and verified. Moreover, the analysis also explores the limitations of Matrix’s key management and potential improvements. Contents 1 Introduction3 1.1 Research questions........................5 1.2 Structure..............................6 2 Preliminaries7 2.1 Data formats used in Matrix...................7 2.2 Security principles........................8 2.2.1 Forward secrecy......................8 2.2.2 Backward secrecy.....................8 2.2.3 Deniability.........................8 2.2.4 Confidentiality.......................8 2.2.5 Integrity..........................9 2.2.6 Authentication.......................9 2.3 Cryptographic primitives used in Matrix............9 2.3.1 Cryptographic hash functions..............9 2.3.2 HMAC............................9 2.3.3 HKDF............................ 10 2.3.4 Cryptographic ratchets.................. 10 2.3.5 Curve25519........................ 11 2.3.6 EdDSA and Ed25519..................
    [Show full text]
  • Csfba00 Icsf Pkcs11 Hcr77c0.Pdf
    z/OS Version 2 Release 3 Cryptographic Services Integrated Cryptographic Service Facility Writing PKCS #11 Applications IBM SC14-7510-04 Note Before using this information and the product it supports, read the information in “Notices” on page 101. This edition applies to ICSF FMID HCR77C0 and Version 2 Release 3 of z/OS (5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. Last updated: 2019-06-24 © Copyright International Business Machines Corporation 2007, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Tables................................................................................................................. vii About this document.............................................................................................ix Who should read this document................................................................................................................. ix How this document is organized.................................................................................................................ix How to use this document.......................................................................................................................... ix Where to find more information...................................................................................................................x IBM Crypto Education.............................................................................................................................x
    [Show full text]
  • Lecture Slides
    CSE 291-I: Applied Cryptography Nadia Heninger UCSD Spring 2020 Lecture 11 Legal Notice The Zoom session for this class will be recorded and made available asynchronously on Canvas to registered students. Announcements 1. HW 5 is due Wednesday! 2. HW 6 will be online this afternoon! Last time: RSA • This time: Attacks on RSA • CCA security • Reminder: Textbook RSA Encryption Key Generation: • 1. N = pq 2. Choose e s.t. gcd(e, φ(N)) = 1 1 = ) 3. d = e− mod φ(N) Le more ECN 4. pk =(N, e), sk =(N, d). Encryption: c = me mod N • d te Decryption: m = c mod N = c mod N • pk =(N, e) c = me mod N m = cd mod N Textbook RSA is insecure Small e attack: If e = 3andm < N1/3, m = c1/3 over Z. no modN - ⇒ 2048- sit N m is 256 bitAES key e.s . - time cube roots our Z : poly known to be efficient cube roots over EINE : not " rub ( RSA assumption taking elm moan is hard) Conclusion : mod N for RSA required security. Textbook RSA is insecure Small e with Chinese Remainder Theorem Assume three parties have RSA keys with e = 3: (3, N1)(3, N2)(3, N3) And the same (full-length) message is encrypted to each: 3 3 3 c1 = m mod N1 c2 = m mod N2 c3 = m mod N3 Use the Chinese remainder theorem to reconstruct c m3 mod N N N ⌘ 1 2 3 3 Now since m < N1N2N3 we are in the same situation as before. over 7L £3 am .
    [Show full text]
  • [PKCS#1] RSA Laboratories, PKCS #1 V2.1: RSA Cryptography Standard, June 14, 2002
    [PKCS#1] RSA Laboratories, PKCS #1 v2.1: RSA Cryptography Standard, June 14, 2002, http://www.preserveitall.org/emc-plus/rsa-labs/standards-initiatives/pkcs-rsa- cryptography-standard.htm. [PKCS#5] RSA Laboratories, PKCS #5 v2.1: Password-Based Cryptography Standard, October 5, 2006, http://www.preserveitall.org/emc-plus/rsa-labs/standards- initiatives/pkcs-5-password-based-cryptography-standard.htm. [PKCS#8] RSA Laboratories, PKCS#8 v1.2: Private-Key Information Syntax Standard, November 1, 1993, http://www.preserveitall.org/emc-plus/rsa-labs/standards- initiatives/pkcs-8-private-key-information-syntax-stand.htm. [PKCS#10] RSA Laboratories, PKCS #10 v1.7: Certification Request Syntax Standard, May 26, 2000, http://www.preserveitall.org/emc-plus/rsa-labs/standards- initiatives/pkcs10-certification-request-syntax-standard.htm. [PKCS#11] OASIS PKCS #11 Cryptographic Token Interface Base Specification Version 3.0 [POLY1305] Daniel J. Bernstein. The Poly1305-AES Message-Authentication Code. In Henri Gilbert and Helena Handschuh, editors, Fast Software Encryption: 12th International Workshop, FSE 2005, Paris, France, February 21-23, 2005, Revised Selected Papers, volume 3557 of Lecture Notes in Computer Science, pages 32–49. Springer, 2005. [RFC1319] B. Kaliski, The MD2 Message-Digest Algorithm, IETF RFC 1319, Apr 1992, http://www.ietf.org/rfc/rfc1319.txt. [RFC1320] R. Rivest, The MD4 Message-Digest Algorithm, IETF RFC 1320, April 1992, http://www.ietf.org/rfc/rfc1320.txt. [RFC1321] R. Rivest, The MD5 Message-Digest Algorithm, IETF RFC 1321, April 1992, http://www.ietf.org/rfc/rfc1321.txt. [RFC1421] J. Linn, Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication Procedures, IETF RFC 1421, February 1993, http://www.ietf.org/rfc/rfc1421.txt.
    [Show full text]
  • XEP-0384: OMEMO Encryption
    XEP-0384: OMEMO Encryption Andreas Straub Daniel Gultsch Tim Henkes mailto:andy@strb:org mailto:daniel@gultsch:de mailto:me@syndace:dev xmpp:andy@strb:org xmpp:daniel@gultsch:de Klaus Herberth Paul Schaub Marvin Wißfeld xmpp:klaus@jsxc:org mailto:vanitasvitae@riseup:net mailto:xmpp@larma:de xmpp:vanitasvitae@jabberhead:tk xmpp:jabber@larma:de 2021-09-28 Version 0.8.0 Status Type Short Name Experimental Standards Track OMEMO This specification defines a protocol for end-to-end encryption in one-to-one chats, as well as group chats where each participant may have multiple clients per account. Legal Copyright This XMPP Extension Protocol is copyright © 1999 – 2020 by the XMPP Standards Foundation (XSF). Permissions Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the ”Specification”), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specifi- cation, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or sub- stantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or pub- lisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.
    [Show full text]
  • Provable Security RSA-PKCS Encryption - Signature
    Provable Security RSA-PKCS Encryption - Signature Lawrence Berkeley National Lab August 2003 David Pointcheval LIENS-CNRS Ecole normale supérieure SSuummmmaarryy • Encryption – PKCS #1 v1.5 – PKCS #1 v2.0 : OAEP • Signature – PKCS #1 v1.5/2.0 – PKCS #1 v2.1 : PSS • Conclusion David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 2 SSuummmmaarryy • Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 3 RRSSAA Rivest - Shamir - Adleman 1978 • n=pq : public modulus en/de-cryption e : public exponent E(m) = me mod n • d=e-1 mod ϕ(n) : private D(c) = cd mod n Relies on the so-called RSA problem: extracting e-th roots mod n David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 4 PPllaaiinn--RRSSAA:: WWeeaakk SSeeccuurriittyy • One-Wayness = RSA Problem • Deterministic: cannot achieve Semantic Security Does c encrypt m0 or m1? Re-encrypt m0, and check whether it is c • Multiplicativity: cannot prevent Chosen-Ciphertext Attacks e With c = Ee(m) = m mod n Compute c’ = 2e c mod n, ask for m’ Note that c’ = (2m)e mod n, thus m = m’/2 mod n ⇒ need of padding David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 5 PPKKCCSS ##11 vv 11..55 Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0 • Efficient encoding/decoding • Probabilistic encryption • Breaks multiplicativity • But… a random ciphertext is valid with non-negligible probability ≈ 2-16 David Pointcheval
    [Show full text]