Skip to Main content Skip to Navigation
New interface
Conference papers

Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH

Abstract : In response to high-profile attacks that exploit hash function collisions, software vendors have started to phase out the use of MD5 and SHA-1 in third-party digital signature applications such as X.509 certificates. However, weak hash constructions continue to be used in various cryptographic constructions within mainstream protocols such as TLS, IKE, and SSH, because practitioners argue that their use in these protocols relies only on second preimage resistance, and hence is unaffected by collisions. This paper systematically investigates and debunks this argument. We identify a new class of transcript collision attacks on key exchange protocols that rely on efficient collision-finding algorithms on the underlying hash constructions. We implement and demonstrate concrete credential-forwarding attacks on TLS 1.2 client authentication, TLS 1.3 server authentication, and TLS channel bindings. We describe almost-practical impersonation and downgrade attacks in TLS 1.1, IKEv2 and SSH-2. As far as we know, these are the first collision-based attacks on the cryptographic constructions used in these popular protocols. Our practical attacks on TLS were responsibly disclosed (under the name SLOTH) and have resulted in security updates to several TLS libraries. Our analysis demonstrates the urgent need for disabling all uses of weak hash functions in mainstream protocols, and our recommendations have been incorporated in the upcoming Token Binding and TLS 1.3 protocols.
Document type :
Conference papers
Complete list of metadata

Cited literature [37 references]  Display  Hide  Download
Contributor : Gaëtan Leurent Connect in order to contact the contributor
Submitted on : Tuesday, March 29, 2016 - 10:48:47 AM
Last modification on : Wednesday, June 8, 2022 - 12:50:05 PM
Long-term archiving on: : Monday, November 14, 2016 - 7:34:29 AM


Files produced by the author(s)




Karthikeyan Bhargavan, Gaëtan Leurent. Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH. Network and Distributed System Security Symposium -- NDSS 2016, Feb 2016, San Diego, United States. ⟨10.14722/ndss.2016.23418⟩. ⟨hal-01244855⟩



Record views


Files downloads