Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH

Abstract : In response to high-profile attacks that exploit hash function collisions, software vendors have started to phase out the use of MD5 and SHA-1 in third-party digital signature applications such as X.509 certificates. However, weak hash constructions continue to be used in various cryptographic constructions within mainstream protocols such as TLS, IKE, and SSH, because practitioners argue that their use in these protocols relies only on second preimage resistance, and hence is unaffected by collisions. This paper systematically investigates and debunks this argument. We identify a new class of transcript collision attacks on key exchange protocols that rely on efficient collision-finding algorithms on the underlying hash constructions. We implement and demonstrate concrete credential-forwarding attacks on TLS 1.2 client authentication, TLS 1.3 server authentication, and TLS channel bindings. We describe almost-practical impersonation and downgrade attacks in TLS 1.1, IKEv2 and SSH-2. As far as we know, these are the first collision-based attacks on the cryptographic constructions used in these popular protocols. Our practical attacks on TLS were responsibly disclosed (under the name SLOTH) and have resulted in security updates to several TLS libraries. Our analysis demonstrates the urgent need for disabling all uses of weak hash functions in mainstream protocols, and our recommendations have been incorporated in the upcoming Token Binding and TLS 1.3 protocols.
Document type :
Conference papers
Complete list of metadatas

Cited literature [37 references]  Display  Hide  Download

https://hal.inria.fr/hal-01244855
Contributor : Gaëtan Leurent <>
Submitted on : Tuesday, March 29, 2016 - 10:48:47 AM
Last modification on : Thursday, April 26, 2018 - 10:28:27 AM
Long-term archiving on: Monday, November 14, 2016 - 7:34:29 AM

File

SLOTH_NDSS16.pdf
Files produced by the author(s)

Identifiers

Collections

Citation

Karthikeyan Bhargavan, Gaëtan Leurent. Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH. Network and Distributed System Security Symposium -- NDSS 2016, Feb 2016, San Diego, United States. ⟨10.14722/ndss.2016.23418⟩. ⟨hal-01244855⟩

Share

Metrics

Record views

908

Files downloads

2919