Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks Christopher Meyer, Juraj Somorovsky, Eugen Weiss, and Jörg Schwenk, Ruhr-University Bochum; Sebastian Schinzel, Münster University of Applied Sciences; Erik Tews, Technische Universität Darmstadt https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/meyer This paper is included in the Proceedings of the 23rd USENIX Security Symposium. August 20–22, 2014 • San Diego, CA ISBN 978-1-931971-15-7 Open access to the Proceedings of the 23rd USENIX Security Symposium is sponsored by USENIX Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks Christopher Meyer, Juraj Somorovsky, Eugen Weiss, Jorg¨ Schwenk Horst Gortz¨ Institute for IT-Security, Ruhr-University Bochum < christopher.meyer, juraj.somorovsky, eugen.weiss, joerg.schwenk @rub.de> { } Sebastian Schinzel <
[email protected]> Department of Computer Science, Munster¨ University of Applied Sciences Erik Tews <
[email protected]> European Center for Security and Privacy by Design,Technische Universitat¨ Darmstadt Abstract TLS impl. Side channel Queries & Efficiency Queries Time As a countermeasure against the famous Bleichenbacher OpenSSL timing O(240) n.a. attack on RSA based ciphersuites, all TLS RFCs starting JSSE error message 177,000 12 h from RFC 2246 (TLS 1.0) propose “to treat incorrectly JSSE timing 18,600 19.5 h formatted messages in a manner indistinguishable from Cavium timing 7371 41 h correctly formatted RSA blocks”. In this paper we show