Practical state recovery attacks against legacy RNG implementations Shaanan N. Cohney Matthew D. Green Nadia Heninger University of Pennsylvania Johns Hopkins University University of Pennsylvania [email protected] [email protected] [email protected] ABSTRACT 1 INTRODUCTION The ANSI X9.17/X9.31 pseudorandom number generator design was Random number generation is a vital component of any crypto- first standardized in 1985, with variants incorporated into numerous graphic system. While systems may survive subtle flaws in crypto- cryptographic standards over the next three decades. The design graphic algorithm implementation, the ability to predict the output uses timestamps together with a statically keyed block cipher to of a (pseudo)random number generator typically leads to the cata- produce pseudo-random output. It has been known since 1998 that strophic failure of any protocol built on top of it. In recent years the key must remain secret in order for the output to be secure. a number of cryptographic systems have been found to include However, neither the FIPS 140-2 standardization process nor NIST’s flawed random and pseudorandom number generation subsystems. later descriptions of the algorithm specified any process for key These flaws range from subtle weaknesses, e.g. biases that admit generation. sophisticated attacks against the protocol [49]; to catastrophic vul- We performed a systematic study of publicly available FIPS 140- nerabilities that allow for adversarial recovery of all random coins 2 certifications for hundreds of products that implemented the used in a protocol execution [16, 59]. In a particularly ominous ANSI X9.31 random number generator, and found twelve whose development, some of these flaws appear to have been deliberately certification documents use of static, hard-coded keys in source engineered. For example, leaks by Edward Snowden indicate that code, leaving the implementation vulnerable to an attacker who the NIST Dual EC DRBG standard may have been designed with can learn this key from the source code or binary. In order to a backdoor [53]. While there is no way to empirically verify this demonstrate the practicality of such an attack, we develop a full allegation, we know for certain that the Dual EC algorithm has passive decryption attack against FortiGate VPN gateway products been successfully exploited: in 2015 Juniper Networks revealed that using FortiOS v4 that recovers the private key in seconds. We their ScreenOS line of VPN devices had been modified to include a measure the prevalence of this vulnerability on the visible Internet malicious set of Dual EC parameters, which likely enabled passive using active scans, and demonstrate state recovery and full private decryption of VPN sessions [16]. key recovery in the wild. Our work highlights the extent to which The problem of constructing random and pseudorandom number the validation and certification process has failed to provide even generators has been extensively explored by industry [8, 41, 48] and modest security guarantees. in the academic literature [20, 21, 42, 55, 57]. Despite the abundant results of this effort, the industry has consistently relied on asmall CCS CONCEPTS number of common pseudorandom number generation algorithms. To a large extent this can be attributed to standards bodies. For ex- • Security and privacy → Cryptanalysis and other attacks; ample, until 2007 there were only two algorithms for pseudorandom Embedded systems security; Security protocols; number generation approved for U.S. FIPS 140 certification, and prior to 1998 only one such algorithm was approved. Recent dis- ACM Reference Format: coveries surrounding the inclusion of flawed generators motivate a Shaanan N. Cohney, Matthew D. Green, and Nadia Heninger. 2018. Prac- more thorough examination of these generators — and particularly, tical state recovery attacks against legacy RNG implementations. In 2018 their use in products. ACM SIGSAC Conference on Computer and Communications Security (CCS ’18), October 15–19, 2018, Toronto, ON, Canada. ACM, New York, NY, USA, The ANSI X9.17/31 standards. The ANSI X9.17 “Financial In- 16 pages. https://doi.org/10.1145/3243734.3243756 stitution Key Management (Wholesale)” standard, first published in 1985, defined a voluntary interoperability standard for crypto- Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed graphic key generation and distribution for the financial industry. for profit or commercial advantage and that copies bear this notice and the full citation This standard included a pseudorandom number generator (PRG) on the first page. Copyrights for components of this work owned by others than the in Appendix C as a suggested method to generate key material. author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission This generator uses a block cipher (in the original description, DES) and/or a fee. Request permissions from [email protected]. to produce output from the current state, and to update the state CCS ’18, October 15–19, 2018, Toronto, ON, Canada using the current time. © 2018 Copyright held by the owner/author(s). Publication rights licensed to the Association for Computing Machinery. ACM ISBN 978-1-4503-5693-0/18/10...$15.00 The same PRG design appeared in US government cryptographic https://doi.org/10.1145/3243734.3243756 standards for the next three decades, occasionally updated with new block ciphers. A subset of the ANSI X9.17-1985 standard was This is not a “NOBUS” backdoor: it is symmetric, and thus an at- adopted as a FIPS standard, FIPS-171, in 1992. FIPS-171 specified that tacker with access to the source code or device can recover the “only NIST-approved key generation algorithms (e.g., the technique secrets needed to compromise the PRG. However, the failure mode defined in Appendix C of ANSI X9.17) shall be used”. FIPS 140-1, of static, discoverable keys we exploit was not ruled out by stan- adopted in 1994, specified that modules should use a FIPS approved dards. The PRG appears to have been independently implemented key generation algorithm; FIPS 186-1, the original version of the in this fashion by a variety of vendors. This is a failure of the stan- DSA standard adopted in 1998, lists the X9.17 PRG as an approved dardization process that has led to real and ongoing vulnerabilities. method to generate private keys. The ANSI X9.31 standard from 1998 specified a variant of the X9.17 PRG using two-key 3DESas We note that this failure mode is more subtle than simply using a the block cipher; this variant was included as an approved random hard-coded key for encrypted communications. There are many number generator in further standards such as FIPS 186-2, from 2004. cryptographically secure PRG constructions using only public pa- NIST published extensions of this design using three-key 3DES and rameters and entropy unknown to the attacker, for example con- AES as the block cipher [40] that were officially included on the structions based on modular exponentiation [11] or hash func- FIPS 140-2 list of approved random number generation algorithms tions [8]. In addition, as we discuss in Section 7, the vulnerability in 2005. could have been rendered practically unexploitable by using suffi- ciently high resolution timestamps. A critical design element of the ANSI X9.17/X9.31 PRG is that the cipher key used with the block cipher remains fixed through each iteration. In order to remain secure, the key must never be revealed 1.1 Our Contributions to external attackers. If an attacker learns this key, they can recover In this work we extend a growing line of research into weak- all future and past states of the PRG from its output by brute forcing ened/backdoored random number generation in deployed prod- the timestamps [42]. Perhaps due to this known weakness, the ANSI ucts [9, 15, 16, 18, 19, 56]. Specifically, we demonstrate the existence X9.17/X9.31 design was deprecated in 2011 and removed from the of widespread and passively exploitable vulnerabilities in imple- FIPS list of approved PRG designs in January 2016. NIST SP 800- mentations of one of the most widely-deployed standard PRGs. Our 131A, the document announcing the deprecation of this algorithm, contributions are as follows: also deprecated a number of smaller cryptographic key sizes along with a rationale for doing so; no rationale appears to have been • We perform a systematic study of FIPS 140 security policy given for the transition away from X9.31. documentation and discover several independently vulnerable RNG implementations from different vendors, and discover Despite this significant flaw, which was identified by Kelsey et al. critical failures in the standardization process. in 1998 [42], the NIST documents specifying the ANSI X9.31 PRG design fail to specify how the cipher key should be generated [40]. • Based on this work, we develop an efficient passive X9.31 state This raises the possibility that even FIPS-validated deployed systems recovery attack for the FortiOS v4 IPsec implementation and could contain vulnerabilities that admit practical PRG state recovery. demonstrate full IPsec VPN decryption. To evaluate this possibility, we performed a systematic study of publicly available FIPS 140-2 certification for hundreds of products • We use Internet-wide measurements to measure the scope of that implemented the ANSI X9.31 random number generator. this vulnerability among publicly-visible hosts, and demon- strate it against hosts in the wild, uncovering more than 25,000 Our results show that a number of vendors use static hard-coded vulnerable hosts. These numbers likely represent a small frac- keys in source code, leaving them vulnerable to an attacker who tion of the true number of vulnerable hosts.