Re: Fwd: Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2

Marked as superceeded by phpseclib's: http://pear.php.net/package/Crypt_RSA/ On Thu, Dec 1, 2011 at 7:38 AM, Daniel O'Connor <daniel.oconnor@gmail.com>wrote: > https://github.com/pear/Crypt_RSA for patches; I've got > NFI how to solve > it except "fork phpseclib's Crypt_RSA" > > > On Thu, Dec 1, 2011 at 4:12 AM, Stefan Neufeind <neufeind@php.net> wrote: > >> Hello PEARs, :-) >> >> just wanted to share that "security-announcement" with you. >> >> >> Regards, >> Stefan >> >> -------- Original Message -------- >> Subject: Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and >> Crypt_RSA2 >> Date: Wed, 30 Nov 2011 11:17:50 +0100 >> From: Daniel Roethlisberger <daniel.roethlisberger@switch.ch> >> Organization: SWITCH-CERT >> To: bugtraq@securityfocus.com >> >> SWITCH-CERT SECURITY ADVISORY >> ============================= >> >> Vulnerability: Insecure Implementation of RSA Encryption >> Affected Products: jCryption, PEAR Crypt_RSA, PEAR Crypt_RSA2 >> Advisory Date: 2011-11-30 >> Advisory Author: Daniel Roethlisberger, SWITCH-CERT >> >> >> ## Introduction >> >> Web applications using jCryption, PEAR Crypt_RSA or Crypt_RSA2 to >> provide confidentiality are vulnerable to exposure of the data >> protected by RSA encryption. >> >> jCryption is a jQuery based library for encrypted transmission of >> HTML form data from web browser to web application. jCryption is >> designed to provide confidentiality against passive attacks. >> PEAR Crypt_RSA and Crypt_RSA2 are libraries providing RSA >> encryption to PHP/PEAR based web applications. PEAR Crypt_RSA2 >> was designed to be compatible with jCryption. >> >> jCryption and PEAR Crypt_RSA2 implement RSA with a static >> checksum and no random padding. PEAR Crypt_RSA implements RSA >> with static padding. The missing randomness in the padding leads >> to a loss of semantic security [1] and thus allows the RSA >> encryption to be broken [2,3] under realistic real-world >> circumstances. >> >> >> ## Affected Products >> >> Vulnerable: >> - jCryption 1.2 >> - jCryption 1.1 >> - PEAR Crypt_RSA >> - PEAR Crypt_RSA2 >> >> Not Vulnerable: >> - phpseclib Crypt_RSA >> >> >> ## Workaround / Solution >> >> Enabling TLS instead of relying on jCryption is a workaround. >> >> In general, only RSA implementations using a secure padding >> scheme such as PKCS#1 OAEP [4] should be used, for example the >> phpseclib version of Crypt_RSA. >> >> >> ## Technical Description >> >> The cryptographical protocol implemented by jCryption 1.2 is as >> follows: >> >> 1) Client requests URL. >> >> 2) Server generates per-session RSA keypair with e = 0x10001 and >> random primes p and q. >> >> 3) Server sends client the HTML form, the jCryption JavaScript >> code and the per-session RSA public key (e, n). >> >> 4) Client encrypts form data as follows: >> checksum = checksum(plaintext); >> ciphertext = RSA_encrypt(checksum || plaintext); >> using modulus n, exponent e, deterministic checksum function >> (modular sum of all bytes) and plain RSA in ECB mode with null >> padding. >> >> 5) Client sends ciphertext to server, which does the reverse of 4 >> to decrypt the message using the per-session private key d. >> >> PEAR Crypt_RSA2 provides RSA encryption/decryption compatible >> with jCryption, thus essentially just step 4. >> >> PEAR Crypt_RSA uses a plain RSA operation in the following way: >> >> ciphertext = RSA_encrypt(plaintext || 0x01); >> >> Using modulus n, exponent e, concatenation ||, and RSA_encrypt() >> being plain RSA in ECB mode with null padding. There is no >> randomness in this scheme. >> >> These are essentially plain textbook RSA with deterministic >> padding. There is a number of well-known attacks against plain >> RSA [2,3]. An attacker with the ability to sniff HTTP traffic >> can use these attacks to break the RSA encryption, which is the >> exact attack scenario that jCryption is designed to protect >> against. The most obvious attack: Because the scheme is not >> semantically secure [1], an attacker can guess likely plaintexts, >> encrypt them using the known public key, and compare the >> resulting cyphertext to the original cyphertext. >> >> The attack scenarios for PEAR Crypt_RSA and Crypt_RSA2 depend on >> the way they are used by an application, but in general, >> confidentiality is lost in the same way. >> >> >> ## Other Attacks >> >> Of course, since the jCryption scheme lacks authentication and >> integrity, it is also vulnerable to active attacks (MitM). >> However, since jCryption was not designed to protect against >> active attacks and does not claim to do so, that's out of scope >> of this advisory, even if it is totally relevant in practice. >> >> >> ## Disclosure Timeline >> >> 2011-11-30: Public disclosure due to no response (jCryption) >> and wont fix (PEAR Crypt_RSA) answers. >> 2011-08-13: PEAR project forwards initial notification to a >> public mailing list; response: wont fix. >> 2011-08-10: PEAR Crypt_RSA original author response: not >> maintained anymore. >> 2011-08-10: Initial vendor/author notification for jCryption >> and PEAR Crypt_RSA. >> 2011-08-02: Discovery by Daniel Roethlisberger, SWITCH-CERT. >> >> >> ## References >> >> [1] http://en.wikipedia.org/wiki/Semantic_security >> >> [2] >> http://en.wikipedia.org/wiki/RSA#Attacks_against_plain_RSA >> >> [3] D. Boneh, A. Joux, P. Nguyen: >> Why Textbook ElGamal and RSA Encryption are Insecure >> >> >> >> http://www.comms.engg.sussex.ac.uk/fft/crypto/Why_Textbook_ElGamal_and_RSA_Encryption_are_Insecure.pdf >> >> [4] RFC 3447: Public-Key Cryptography Standards (PKCS) #1: >> RSA Cryptography Specifications Version 2.1 >> https://www.ietf.org/rfc/rfc3447.txt >> >> -- >> PEAR QA Mailing List (http://pear.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> >> >