Re: [TLS] TLS and hardware security modules - some issues related to PKCS11

[Michael StJohns <[e-mail]>]

On 9/19/2013 3:38 AM, Juraj Somorovsky wrote:
> Let me please extend your scenario:
> o Consider  an application that needs to produce 2 128 bit AES keys.
> o Consider that an attacker (or a hacked program that's being used to
> extract keys) re-runs the derivation using the same master key and same
> random data, this time specifying 64 bits of DES keys.
> o Consider that the attacker can "break" DES (can get key from
> plaintext-ciphertext pairs), but cannot break AES.
>
> The part of the key stream previously used for AES is now assigned to
> the DES keys. If the PKCS11 module now produces some
> plaintext-ciphertext pairs, the attacker can break DES and thus gets
> part of the key stream previously assigned to AES.
>
> I admit I am not that familiar with PKCS11 modules used in
> TLS...However, would this be a valid scenario?

Yes and yes.

Yes - PKCS11 doesn't actually get any information on the specific TLS 
suite, so it doesn't know what keys are required or their length.   And 
the suites are all over the place in required keys and lengths - the 
null encryption suites don't require encryption keys, and the AEAD 
suites don't require MAC keys, so PKCS11 can't really enforce minimum 
lengths there.

Yes - yuck - I didn't even consider this.  Even if you don't leak out 
into the IV, there are crypto algorithms still in use with way too short 
key lengths.  You could do exactly what you said and use this to brute 
force the DES 56 bit keys (plus 8 parity) and then concatenate the 
individual results to get the AES keys.


Thanks for this.  I think it can be fixed though and relatively simply, 
but will require changes to the key expansion step that are a bit more 
than I suggested:

E.g. in addition to the master_key, label and random data being fed into 
the KDF, also feed in - in order for each output key - 2 or 4 bytes each 
that describe the length of the key.  And that's taken directly from the 
inputs for the key lengths requested.

That means that any time you vary the length of ANY key in the key 
expansion, the entire key stream changes.

It also means that there isn't a need for a separate IV sub key for the 
key expansion stage (I think....)

I'll write it up.

Mike