ROCA vulnerability

Short description: Cryptographic vulnerability

ROCA vulnerabilityCVE identifier(s)| CVE-2017-15361

|

Date discovered| February 2017; 9 years ago (February 2017)
Discoverer| Matúš Nemec, Marek Sýs, et al. (Masaryk University)
Affected hardware| TPMs, YubiKeys, Gemalto IDPrime .NET smart cards
Affected software| Any asymmetric encryption that used RSALib, including BitLocker and PGP

The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability. "ROCA" is an acronym for "Return of Coppersmith's attack".[1] The vulnerability has been given the identifier CVE-2017-15361.

The vulnerability arises from an approach to RSA key generation used in vulnerable versions of the software library RSALib provided by Infineon Technologies and incorporated into many smart cards, Trusted Platform Modules (TPM), and Hardware Security Modules (HSM), including YubiKey 4 tokens when used to generate RSA keys on-chip for OpenPGP or PIV.[2] RSA keys of lengths 512, 1024, and 2048 bits generated using these versions of the Infineon library are vulnerable to a practical ROCA attack.[3][4] The research team that discovered the attack (all with Masaryk University and led by Matúš Nemec and Marek Sýs)[3] estimate that it affected around one-quarter of all current TPM devices globally.[5] Millions of smart cards are believed to be affected.[1]

The team informed Infineon of the RSALib problem in February 2017, but withheld public notice until mid-October, citing responsible disclosure. At that time they announced the attack and provided a tool to test public keys for vulnerability. They published the details of the attack in November.[3]

## Contents

* 1 Technical details
* 2 Mitigation
* 3 Implications
* 4 See also
* 5 References
* 6 External links

## Technical details

Generating an RSA key involves selecting two large randomly-generated prime numbers, a process that can be time-consuming, particularly on small devices, such as smart cards. In addition to being primes, the numbers should have certain other properties for best security. The vulnerable RSALib selection process quickly creates primes of the desired type by only testing for primality numbers of the form k×M+(65537amodM), where M is the product of the first n successive primes (2, 3, 5, 7, 11, 13, ...), and n is a constant that only depends on the desired key size. The security is based on the secret constants k and a. The ROCA attack exploits this particular format for primes using a variation of the Coppersmith method. In addition, public keys generated this way have a distinctive fingerprint that can be quickly recognized by attempting to compute the discrete logarithm of the public key mod M to base 65537. Computing discrete logarithms in a large group is usually extremely difficult, but in this case it can be done efficiently using the Pohlig–Hellman algorithm because M is a smooth number. A test site is available on the Internet.[3][6][7][8] In short, keys that fit this format have significantly lower entropy and can be attacked relatively efficiently (weeks to months), and the format can be confirmed ("fingerprinted") by the attacker very quickly (microseconds). Multiple implementations of the attack are publicly available.[9][10][11]

## Mitigation

The ROCA authors consider public keys of length 512, 1024 and 2048-bits generated by RSALib to be vulnerable. Because the details of key generation differ for different key lengths, shorter keys are not necessarily more vulnerable than longer keys. For example, a 1952-bit RSAlib key is stronger than a 2048-bit key and a 4096-bit key is weaker than a 3072-bit key.

The best mitigation, according to the authors, is to generate RSA keys using a stronger method, such as by OpenSSL. If that is not possible, the ROCA authors suggest using key lengths that are less susceptible to ROCA such as 3936-bit, 3072-bit or, if there is a 2048-bit key size maximum, 1952-bits.[3]: Sec 5.1

Infineon has released firmware updates for its Trusted Platform Modules to manufacturers who have used its TPMs.[12]

## Implications

The vulnerability highlighted several shortcomings of the Common Criteria certification scheme as the vulnerability was present in a list of Common Criteria certified smart card products. Namely, the approval of homegrown cryptographic algorithms; the lack of transparency in certification reports, inability to revoke Common Criteria certificates for known vulnerable products and distribute this information to the users of the certified products.[13]: Sec 6.7.5

In Estonia, the discovery of the vulnerability resulted in a state-level cyber crisis as the vulnerable smart card chip was deployed on more than 750,000 Estonian identity cards that are used daily by Estonian residents and e-residents to securely authenticate online and create digital signatures.[13]: Sec 6.7

## See also

* BitLocker § Security concerns
* Infineon Technologies § Security flaw
* Trusted Platform Module

## References

1. ↑ 1.0 1.1 Goodin, Dan (2017-10-23). "Crippling crypto weakness opens millions of smartcards to cloning" (in en-us). Ars Technica. https://arstechnica.com/information-technology/2017/10/crippling-crypto-weakness-opens-millions-of-smartcards-to-cloning/.
2. ↑ Bucy, Daniel (2022-11-23). "Infineon RSA Key Generation Issue - Customer Portal". https://support.yubico.com/hc/en-us/articles/360021803580-Infineon-RSA-Key-Generation-Issue-Customer-Portal.
3. ↑ 3.0 3.1 3.2 3.3 3.4 Nemec, Matus; Sys, Marek; Svenda, Petr; Klinec, Dusan; Matyas, Vashek (November 2017). "The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli". doi:10.1145/3133956.3133969. https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf.
4. ↑ Khandelwal, Swati. "Serious Crypto-Flaw Lets Hackers Recover Private RSA Keys Used in Billions of Devices". The Hacker News. https://thehackernews.com/2017/10/rsa-encryption-keys.html.
5. ↑ Leyden, John (16 October 2017). "Never mind the WPA2 drama... Details emerge of TPM key cockup that hits tonnes of devices". United Kingdom: The Register. https://www.theregister.co.uk/2017/10/16/roca_crypto_vuln_infineon_chips/.
6. ↑ "ROCA: Infineon TPM and Secure Element RSA Vulnerability Guidance". United Kingdom. https://www.ncsc.gov.uk/guidance/roca-infineon-tpm-and-secure-element-rsa-vulnerability-guidance.
7. ↑ "ROCA: Vulnerable RSA generation (CVE-2017-15361)". Czech Republic: Centre for Research on Cryptography and Security, Faculty of Informatics, Masaryk University. https://crocs.fi.muni.cz/public/papers/rsa_ccs17.
8. ↑ "Information on software update of RSA key generation function". Infineon Technologies AG. https://www.infineon.com/cms/en/product/promopages/rsa-update/.
9. ↑ Bruno Produit (2019-05-15). "Implementation of the ROCA attack (CVE-2017-15361)". https://github.com/brunoproduit/roca.
10. ↑ Florian Picca (2020-05-03). "ROCA". https://github.com/FlorianPicca/ROCA.
11. ↑ Shiho Midorikawa (2020-04-13). "ROCA". https://github.com/elliptic-shiho/crypto_misc/blob/master/small_root/roca_attack.sage.
12. ↑ ""TPM Update - Infineon Technologies"". https://www.infineon.com/cms/en/product/promopages/tpm-update/.
13. ↑ 13.0 13.1 Parsovs, Arnis (March 2021). Estonian Electronic Identity Card and its Security Challenges (PhD). University of Tartu.

## External links

* ROCA detection tool (Detection source code)
* ROCA Vulnerability Test Suite (Online tool for testing keys, files, GitHub accounts, GnuPG keys, and includes an S/MIME and PGP email responder)
* TrustMonitor ROCA Vulnerability Test (Online tool for testing multiple certificates)
* Detect Trusted Platform Modules Vulnerable to CVE-2017-15361 (Scripts)

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/ROCA vulnerability. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=ROCA_vulnerability&oldid=4158196"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template