How is the NSA breaking SSL?

If you’ve been following the news about government spying, you should know by now, thanks to information revealed by Edward Snowden, that the USA’s National Security Agency (NSA) and UK’s Government Communications Headquarters (GCHQ) have been going gangbusters on the infrastructure that underpins Internet security.

Through programs like Bullrun and Edgehill, both spy agencies have likely been breaking SSL at will for a long time. But how exactly are they doing it?

Unless somebody with direct knowledge of the programs is willing to talk, all we can do is speculate. Matthew Green, a cryptographer and research professor at Johns Hopkins University, Baltimore, MD, USA, has done just that, discussing all the possible means that the spy agencies break SSL. Here’s what he wrote about one of those methods – weakening random number generators:

…The security of TLS depends fundamentally on the availability of unpredictable random numbers. Not coincidentally, tampering with random number generator standards appears to have been a particular focus of NSA’s efforts.

Random numbers are critical to a number of elements in TLS, but they’re particularly important in three places:

  1. On the client side, during the RSA handshake. The RNG is used to generate the RSA pre-master secret and encryption padding. If the attacker can predict the output of this generator, she can subsequently decrypt the entire session. Ironically, a failure of the server RNG is much less devastating to the RSA handshake.**
  2. On the client or server side, during the Diffie-Hellman handshake(s). Since Diffie-Hellman requires a contribution from each side of the connection, a predictable RNG on either side renders the session completely transparent.
  3. During long-term key generation, particularly of RSA keys. If this happens, you’re screwed.

And you just don’t need to be that sophisticated to weaken a random number generator. These generators are already surprisingly fragile, and it’s awfully difficult to detect when one is broken. Debian’s maintainers made this point beautifully back in 2008 when an errant code cleanup reduced the effective entropy of OpenSSL to just 16 bits. In fact, RNGs are so vulnerable that the challenge here is not weakening the RNG — any idiot with a keyboard can do that — it’s doing so without making the implementation trivially vulnerable to everyone else.

The good news is that it’s relatively easy to tamper with an SSL implementation to make it encrypt and exfiltrate the current RNG seed. This still requires someone to physically alter the library, or install a persistent exploit, but it can be done cleverly without even adding much new code to the existing OpenSSL code. (OpenSSL’s love of function pointers makes it particularly easy to tamper with this stuff.)

If tampering isn’t your style, why not put the backdoor in plain sight? That’s the approach NSA took with the Dual_EC RNG, standardized by NIST in Special Publication 800-90. There’s compelling evidence that NSA deliberately engineered this generator with a backdoor — one that allows them to break any TLS/SSL connection made using it. Since the generator is (was) the default in RSA’s BSAFE library, you should expect every TLS connection made using that software to be potentially compromised.

And I haven’t even mentioned Intel’s plans to replace the Linux kernel RNG with its own hardware RNG.

Interesting stuff. If this type of material tickles your fancy, read the complete article here.

Related Posts

Intel’s Compute Stick and your favorite Linux distribution With the announcement of the Compute Stick, Intel has signaled its intent to battle for market share at the low end of the mobile computing space. ...
Let’s Encrypt to offer free, automated and open SSL/TLS domain certificates Come Summer 2015, webmasters not already using SSL/TLS certificates to encrypt their website's traffic will be able to do so for free using a single p...
What’s new in Kate Kate is a professional text editor for the K Desktop Environment (KDE). It is one of the most feature-rich and advanced text editors available on any ...
Quad-core Android SmartTV on a stick A new USB stick-sized Android SmartTV from Sanko Co., Ltd of Japan features a quad-core 1.2 GHz Freescale i.mx6 processor. I think that's more power t...
U.S. To Introduce Draconian Anti-Piracy Censorship Bill The U.S. Government is determined to put an end to online piracy. In an attempt to give copyright holders and the authorities all the tools required t...
Feed-forward clock synchronization algorithms project The FreeBSD Foundation is pleased to announce that Julien Ridoux and Darryl Veitch at the University of Melbourne have been awarded a grant to imple...

We Recommend These Vendors

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Leave a Comment

Your email address will not be published. Required fields are marked *