Lucky Thirteen - Revision history

NKirnbauer: category removed to achive article

2024-10-22T17:20:01Z

category removed to achive article

← Older revision		Revision as of 17:20, 22 October 2024
Line 98:		Line 98:
	* https://medium.com/@c0D3M/lucky-13-attack-explained-dd9a9fd42fa6		* https://medium.com/@c0D3M/lucky-13-attack-explained-dd9a9fd42fa6
	* https://www.youtube.com/watch?v=4EgD4PEatA8		* https://www.youtube.com/watch?v=4EgD4PEatA8

	~~[[Category:Documentation]]~~

JWellbrock: /* Block Cipher (CBC Mode) */

2023-01-04T18:04:57Z

Block Cipher (CBC Mode)

← Older revision		Revision as of 18:04, 4 January 2023
Line 28:		Line 28:
	== Block Cipher (CBC Mode) ==		== Block Cipher (CBC Mode) ==

	[[File:CBC Mode.jpg\|~~300px~~]]		[[File:CBC Mode.jpg\|600px]]

	In CBC Mode the Plaintext is encrypted with the Initialization Vector and the key through XOR Operation.		In CBC Mode the Plaintext is encrypted with the Initialization Vector and the key through XOR Operation.
Line 34:		Line 34:
	; Encryption:		; Encryption:

	[[File:Encryption.jpg\|~~300px~~]]		[[File:Encryption.jpg\|600px]]

	[[File:Encryption2.jpg\|~~300px~~]]		[[File:Encryption2.jpg\|600px]]

	; Decryption:		; Decryption:

	[[File:Decryption.jpg\|~~300px~~]]		[[File:Decryption.jpg\|600px]]

	=== Padding Standard ===		=== Padding Standard ===

JWellbrock: /* The attack */

2023-01-04T18:04:26Z

The attack

← Older revision		Revision as of 18:04, 4 January 2023
Line 68:		Line 68:
	* Force the decrypted plaintext to have valid padding by manipulating the input ciphertext		* Force the decrypted plaintext to have valid padding by manipulating the input ciphertext

	[[File:Attack.jpg\|~~300px~~]]		[[File:Attack.jpg\|600px]]

	The attacker changes the last bit of the ciphertext t1 and waits for the server to answer if the padding is valid or invalid. If the padding is valid the attacker knows the last bit of C1 (t1) and the last bit of P2 (01).		The attacker changes the last bit of the ciphertext t1 and waits for the server to answer if the padding is valid or invalid. If the padding is valid the attacker knows the last bit of C1 (t1) and the last bit of P2 (01).
	So X1 = t1 ⨁ 01.		So X1 = t1 ⨁ 01.
	With this the attacker can guess the plaintext.		With this the attacker can guess the plaintext.


	== Mitigation ==		== Mitigation ==

JWellbrock: /* Oracle */

2023-01-04T18:04:10Z

Oracle

← Older revision		Revision as of 18:04, 4 January 2023
Line 54:		Line 54:
	=== Oracle ===		=== Oracle ===

	[[File:Oracle.jpg\|~~300px~~]]		[[File:Oracle.jpg\|200px]]

	The Oracle is the server who answers to the question if the padding is valid.		The Oracle is the server who answers to the question if the padding is valid.

JWellbrock: /* Padding Standard */

2023-01-04T18:03:58Z

Padding Standard

← Older revision		Revision as of 18:03, 4 January 2023
Line 46:		Line 46:
	With CBC-Mode the Ciphertext is split into Blocks. All Blocks have the same length of 8 bits. So, it could be necessary to fil up the last bits with padding.		With CBC-Mode the Ciphertext is split into Blocks. All Blocks have the same length of 8 bits. So, it could be necessary to fil up the last bits with padding.

	[[File:Padding.jpg\|~~300px~~]]		[[File:Padding.jpg\|600px]]

	A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.		A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.

JWellbrock: /* Block Cipher (CBC Mode) */

2023-01-04T18:03:37Z

Block Cipher (CBC Mode)

← Older revision		Revision as of 18:03, 4 January 2023
Line 50:		Line 50:
	A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.		A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.

	[[File:Padding2.jpg\|~~600px~~]]		[[File:Padding2.jpg\|700px]]

	=== Oracle ===		=== Oracle ===

JWellbrock at 18:03, 4 January 2023

2023-01-04T18:03:11Z

← Older revision		Revision as of 18:03, 4 January 2023
Line 50:		Line 50:
	A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.		A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.

	[[File:Padding2.jpg\|~~300px~~]]		[[File:Padding2.jpg\|600px]]

	=== Oracle ===		=== Oracle ===

JWellbrock at 17:58, 4 January 2023

2023-01-04T17:58:06Z

← Older revision		Revision as of 17:58, 4 January 2023
Line 17:		Line 17:
	The XOR operation (short for "exclusive OR") is a logical operation that takes two input values and returns an output value of true (1) if and only if exactly one of the input values is true (1). If both input values are true or both input values are false, the output value is false (0). The truth table for the XOR operation is shown below:		The XOR operation (short for "exclusive OR") is a logical operation that takes two input values and returns an output value of true (1) if and only if exactly one of the input values is true (1). If both input values are true or both input values are false, the output value is false (0). The truth table for the XOR operation is shown below:

	[[File:Wahrheitstabelle.~~jpg~~\|~~600px~~]]		[[File:Wahrheitstabelle.JPG\|300 px]]

	The XOR operation is done byte-by-byte, bit-by-bit and it is important that if there are two known values it is possible to get the remaining:		The XOR operation is done byte-by-byte, bit-by-bit and it is important that if there are two known values it is possible to get the remaining:
Line 28:		Line 28:
	== Block Cipher (CBC Mode) ==		== Block Cipher (CBC Mode) ==

	[[File:CBC Mode.jpg\|~~600px~~]]		[[File:CBC Mode.jpg\|300px]]

	In CBC Mode the Plaintext is encrypted with the Initialization Vector and the key through XOR Operation.		In CBC Mode the Plaintext is encrypted with the Initialization Vector and the key through XOR Operation.
Line 34:		Line 34:
	; Encryption:		; Encryption:

	[[File:Encryption.jpg\|~~600px~~]]		[[File:Encryption.jpg\|300px]]

	[[File:Encryption2.jpg\|~~600px~~]]		[[File:Encryption2.jpg\|300px]]

	; Decryption:		; Decryption:

	[[File:Decryption.jpg\|~~600px~~]]		[[File:Decryption.jpg\|300px]]

	=== Padding Standard ===		=== Padding Standard ===
Line 46:		Line 46:
	With CBC-Mode the Ciphertext is split into Blocks. All Blocks have the same length of 8 bits. So, it could be necessary to fil up the last bits with padding.		With CBC-Mode the Ciphertext is split into Blocks. All Blocks have the same length of 8 bits. So, it could be necessary to fil up the last bits with padding.

	[[File:Padding.jpg\|~~600px~~]]		[[File:Padding.jpg\|300px]]

	A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.		A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.

	[[File:Padding2.jpg\|~~600px~~]]		[[File:Padding2.jpg\|300px]]

	=== Oracle ===		=== Oracle ===
Line 68:		Line 68:
	* Force the decrypted plaintext to have valid padding by manipulating the input ciphertext		* Force the decrypted plaintext to have valid padding by manipulating the input ciphertext

	[[File:Attack.jpg\|~~600px~~]]		[[File:Attack.jpg\|300px]]

	The attacker changes the last bit of the ciphertext t1 and waits for the server to answer if the padding is valid or invalid. If the padding is valid the attacker knows the last bit of C1 (t1) and the last bit of P2 (01).		The attacker changes the last bit of the ciphertext t1 and waits for the server to answer if the padding is valid or invalid. If the padding is valid the attacker knows the last bit of C1 (t1) and the last bit of P2 (01).

JWellbrock at 11:12, 4 January 2023

2023-01-04T11:12:07Z

← Older revision		Revision as of 11:12, 4 January 2023
Line 75:		Line 75:


	== Mitigation: ==		== Mitigation ==

	* No answer from the server if the padding is valid or not		* No answer from the server if the padding is valid or not

JWellbrock: Created page with "== Summary == The Lucky Thirteen vulnerability is a TLS vulnerability based on the Padding Oracle Attack. It was discovered by Nadhem AlFardan and Kenny Paterson (University of London) in 2013 and named as CVE-2013-0169. The Lucky Thirteen attack is a timing-side channel attack where the answer times of the server are analyzed. == The Padding Oracle Attack == The Padding Oracle Attack is a TLS vulnerability which allows an attacker to retrieve the original plaintext..."

2023-01-04T11:10:23Z

Created page with "== Summary == The Lucky Thirteen vulnerability is a TLS vulnerability based on the Padding Oracle Attack. It was discovered by Nadhem AlFardan and Kenny Paterson (University of London) in 2013 and named as CVE-2013-0169. The Lucky Thirteen attack is a timing-side channel attack where the answer times of the server are analyzed. == The Padding Oracle Attack == The Padding Oracle Attack is a TLS vulnerability which allows an attacker to retrieve the original plaintext..."

New page

== Summary ==

The Lucky Thirteen vulnerability is a TLS vulnerability based on the Padding Oracle Attack. It was discovered by Nadhem AlFardan and Kenny Paterson (University of London) in 2013 and named as
CVE-2013-0169. The Lucky Thirteen attack is a timing-side channel attack where the answer times of the server are analyzed.

== The Padding Oracle Attack ==

The Padding Oracle Attack is a TLS vulnerability which allows an attacker to retrieve the original plaintext from the ciphertext. There are 4 main things needed for the attack:

* XOR Operation
* Block Cipher (CBC Mode)
* Padding Standard
* Oracle

== XOR Operation ==

The XOR operation (short for "exclusive OR") is a logical operation that takes two input values and returns an output value of true (1) if and only if exactly one of the input values is true (1). If both input values are true or both input values are false, the output value is false (0). The truth table for the XOR operation is shown below:

[[File:Wahrheitstabelle.jpg|600px]]

The XOR operation is done byte-by-byte, bit-by-bit and it is important that if there are two known values it is possible to get the remaining:

* A ⨁ B = C
* A ⨁ C = B
* B ⨁ C = A

== Block Cipher (CBC Mode) ==

[[File:CBC Mode.jpg|600px]]

In CBC Mode the Plaintext is encrypted with the Initialization Vector and the key through XOR Operation.

; Encryption:

[[File:Encryption.jpg|600px]]

[[File:Encryption2.jpg|600px]]

; Decryption:

[[File:Decryption.jpg|600px]]

=== Padding Standard ===

With CBC-Mode the Ciphertext is split into Blocks. All Blocks have the same length of 8 bits. So, it could be necessary to fil up the last bits with padding.

[[File:Padding.jpg|600px]]

A common system of padding is Public Key Cryptography Standard #7, or PKCS #7.

[[File:Padding2.jpg|600px]]

=== Oracle ===

[[File:Oracle.jpg|300px]]

The Oracle is the server who answers to the question if the padding is valid.

== The attack ==

There are some important points for the attack:

* A “yes” from the Oracle helps narrow down things further than a “no“
* The attacker knows the ciphertext (and therefore the ciphertext blocks)
* The attacker can control which ciphertext is input into the Padding Oracle
* By changing the ciphertext input, the attacker also changes the decrypted plaintext that the Padding Oracle sees
* Force the decrypted plaintext to have valid padding by manipulating the input ciphertext

[[File:Attack.jpg|600px]]

The attacker changes the last bit of the ciphertext t1 and waits for the server to answer if the padding is valid or invalid. If the padding is valid the attacker knows the last bit of C1 (t1) and the last bit of P2 (01).
So X1 = t1 ⨁ 01.
With this the attacker can guess the plaintext.

== Mitigation: ==

* No answer from the server if the padding is valid or not
* Leads to timing attack (Lucky thirteen)
* Write the code in such a way that success and error cases consume same time so that an attacker cannot measure the time difference.
* Do not use CBC-Mode Encryption

== References ==

; Seminar paper :
* [[File:Lucky Thirteen.pdf]]

; References
* Kenny Paterson. Lucky 13, beast, crime, ... is tls dead, or just resting?, 2022.
* Pratik Guha Sarkar and Shawn Fitzgerald. Attacks on ssl a comprehensive study of beast, crime, time, breach, lucky 13 & rc4 biases. August 2013.
* Nadhem J. AlFardan and Kenneth G. Paterson. Lucky Thirteen: Breaking the TLS and DTLS Record Protocols. February 2013.

; Links
* https://en.wikipedia.org/wiki/Exclusive_or
* https://www.elektronik-kompendium.de/sites/dig/0205186.htm#:~:text=Das%20XOR%20ist%20ein%20zusammengeschaltetes,A%20und%20B%20ungleich%20sind
* https://web.engr.oregonstate.edu/~rosulekm/crypto/padding.html#attack
* https://samsclass.info/141/proj/p14pad.htm
* https://medium.com/@c0D3M/lucky-13-attack-explained-dd9a9fd42fa6
* https://www.youtube.com/watch?v=4EgD4PEatA8

[[Category:Documentation]]