How is the NSA breaking SSL?

If you’ve been following the news about government spying, you should know by now, thanks to information revealed by Edward Snowden, that the USA’s National Security Agency (NSA) and UK’s Government Communications Headquarters (GCHQ) have been going gangbusters on the infrastructure that underpins Internet security.

Through programs like Bullrun and Edgehill, both spy agencies have likely been breaking SSL at will for a long time. But how exactly are they doing it?

Unless somebody with direct knowledge of the programs is willing to talk, all we can do is speculate. Matthew Green, a cryptographer and research professor at Johns Hopkins University, Baltimore, MD, USA, has done just that, discussing all the possible means that the spy agencies break SSL. Here’s what he wrote about one of those methods – weakening random number generators:

…The security of TLS depends fundamentally on the availability of unpredictable random numbers. Not coincidentally, tampering with random number generator standards appears to have been a particular focus of NSA’s efforts.

Random numbers are critical to a number of elements in TLS, but they’re particularly important in three places:

  1. On the client side, during the RSA handshake. The RNG is used to generate the RSA pre-master secret and encryption padding. If the attacker can predict the output of this generator, she can subsequently decrypt the entire session. Ironically, a failure of the server RNG is much less devastating to the RSA handshake.**
  2. On the client or server side, during the Diffie-Hellman handshake(s). Since Diffie-Hellman requires a contribution from each side of the connection, a predictable RNG on either side renders the session completely transparent.
  3. During long-term key generation, particularly of RSA keys. If this happens, you’re screwed.

And you just don’t need to be that sophisticated to weaken a random number generator. These generators are already surprisingly fragile, and it’s awfully difficult to detect when one is broken. Debian’s maintainers made this point beautifully back in 2008 when an errant code cleanup reduced the effective entropy of OpenSSL to just 16 bits. In fact, RNGs are so vulnerable that the challenge here is not weakening the RNG — any idiot with a keyboard can do that — it’s doing so without making the implementation trivially vulnerable to everyone else.

The good news is that it’s relatively easy to tamper with an SSL implementation to make it encrypt and exfiltrate the current RNG seed. This still requires someone to physically alter the library, or install a persistent exploit, but it can be done cleverly without even adding much new code to the existing OpenSSL code. (OpenSSL’s love of function pointers makes it particularly easy to tamper with this stuff.)

If tampering isn’t your style, why not put the backdoor in plain sight? That’s the approach NSA took with the Dual_EC RNG, standardized by NIST in Special Publication 800-90. There’s compelling evidence that NSA deliberately engineered this generator with a backdoor — one that allows them to break any TLS/SSL connection made using it. Since the generator is (was) the default in RSA’s BSAFE library, you should expect every TLS connection made using that software to be potentially compromised.

And I haven’t even mentioned Intel’s plans to replace the Linux kernel RNG with its own hardware RNG.

Interesting stuff. If this type of material tickles your fancy, read the complete article here.

Related Posts

Methane-Powered Laptops? Materials Scientists Unveil Tiny, Low-Temperature Methane Fuel Ce... Making fuel cells practical and affordable will not happen overnight. It may, however, not take much longer. With advances in nanostructured devices, ...
Nuvola Player needs a new maintainer Nuvola Player is a graphical interface for tuning in to all your Cloud-based music services. I first wrote about it a month ago (see Nuvola Player: En...
Joli OS and Jolicloud Desktop Environment to be discontinued Joli OS and Jolicloud Desktop Environment will no longer be supported after December 31 2013. That, for Jolicloud users, is the bad news from the P...
A Logstash Tutorial: How to Get Started Editor: The ELK stack is made up of three applications - Elasticsearch, Logstash, and Kibana. This article is about the "L" in the ELK stack. A gr...
Tectonic Preview is now open to the public Tectonic is an enterprise platform that provides out-of-the-box Kubernetes clusters on CoreOS Linux. Kubernetes is a Google-sponsored platform for...
Let’s Encrypt will enter public beta on December 3 2015 Let’s Encrypt is an initiative of the Internet Security Research Group (ISRG) with the goal of providing free and automatic SSL certificate installati...

We Recommend These Vendors and Free Offers

ContainerizeThis 2016 is a free, 2-day conference for all things containers and big data. Featured, will be presentations and free, hands-on workshops. Learn more at ContainerizeThis.com

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


Leave a Comment

Your email address will not be published. Required fields are marked *

*