We found out that in contrast to public knowledge, the Pre-Shared Key (PSK) authentication method in main mode of IKEv1 is susceptible to offline dictionary attacks. This requires only a single active Man-in-the-Middle attack. Thus, if low entropy passwords are used as PSKs, this can easily be broken.
This week at the USENIX Security conference, Dennis Felsch will present our research paper on IPsec attacks: The Dangers of Key Reuse: Practical Attacks on IPsec IKE. [alternative link to the paper]
In his blog post, Dennis showed how to attack the public key encryption based authentication methods of IKEv1 (PKE & RPKE) and how to use this attack against IKEv2 signature based authentication method. In this blog post, I will focus on another interesting finding regarding IKEv1 and the Pre-Shared Key authentication.
IPsec and Internet Key Exchange (IKE)
IPsec enables cryptographic protection of IP packets. It is commonly used to build VPNs (Virtual Private Networks). For key establishment, the IKE protocol is used. IKE exists in two versions, each with different modes, different phases, several authentication methods, and configuration options. Therefore, IKE is one of the most complex cryptographic protocols in use.
In version 1 of IKE (IKEv1), four authentication methods are available for Phase 1, in which initial authenticated keying material is established: Two public key encryption based methods, one signature based method, and a PSK (Pre-Shared Key) based method.
Pre-Shared Key authentication
As shown above, Pre-Shared Key authentication is one of three authentication methods in IKEv1. The authentication is based on the knowledge of a shared secret string. In reality, this is probably some sort of password.
The IKEv1 handshake for PSK authentication looks like the following (simplified version):
In the first two messages, the session identifier (inside HDR) and the cryptographic algorithms (proposals) are selected by initiator and responder.
In messages 3 and 4, they exchange ephemeral Diffie-Hellman shares and nonces. After that, they compute a key k by using their shared secret (PSK) in a PRF function (e.g. HMAC-SHA1) and the previously exchanged nonces. This key is used to derive additional keys (ka, kd, ke). The key kd is used to compute MACI over the session identifier and the shared diffie-hellman secret gxy. Finally, the key ke is used to encrypt IDI (e.g. IPv4 address of the peer) and MACI.
Weaknesses of PSK authentication
It is well known that the aggressive mode of authentication in combination with PSK is insecure and vulnerable against off-line dictionary attacks, by simply eavesedropping the packets. For example, in strongSwan it is necessary to set the following configuration flag in order to use it:
charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes
For the main mode, we found a similar attack when doing some minor additional work. For that, the attacker needs to waits until a peer A (initiator) tries to connect to another peer B (responder). Then, the attacker acts as a man-in-the middle and behaves like the peer B would, but does not forward the packets to B.
From the picture above it should be clear that an attacker who acts as B can compute (gxy) and receives the necessary public values session ID, nI, nR. However, the attacker does not know the PSK. In order to mount a dictionary attack against this value, he uses the nonces, and computes a candidate for k for every entry in the dictionary. It is necessary to make a key derivation for every k with the values of the session identifiers and shared Diffie-Hellmann secret the possible keys ka, kd and ke. Then, the attacker uses ke in order to decrypt the encrypted part of message 5. Due to IDI often being an IP address plus some additional data of the initiator, the attacker can easily determine if the correct PSK has been found.
Who is affected?
This weakness exists in the IKEv1 standard (RFC 2409). Every software or hardware that is compliant to this standard is affected. Therefore, we encourage all vendors, companies, and developers to at least ensure that high-entropy Pre-Shared Keys are used in IKEv1 configurations.
In order to verify the attack, we tested the attack against strongSWAN 5.5.1.
Proof-of-Concept
We have implemented a PoC that runs a dictionary attack against a network capture (pcapng) of a IKEv1 main mode session. As input, it also requires the Diffie-Hellmann secret as described above. You can find the source code at github. We only tested the attack against strongSWAN 5.5.1. If you want to use the PoC against another implementation or session, you have to adjust the idHex value in main.py.
Responsible Disclosure
We reported our findings to the international CERT at July 6th, 2018. We were informed that they contacted over 250 parties about the weakness. The CVE ID for it is CVE-2018-5389 [cert entry].
Credits
On August 10th, 2018, we learned that this attack against IKEv1 main mode with PSKs was previously described by David McGrew in his blog post Great Cipher, But Where Did You Get That Key?. We would like to point out that neither we nor the USENIX reviewers nor the CERT were obviously aware of this.
On August 14th 2018, Graham Bartlett (Cisco) email us that he presented the weakness of PSK in IKEv2 in several public presentations and in his book.
On August 15th 2018, we were informed by Tamir Zegman that John Pliam described the attack on his web page in 1999.
On August 14th 2018, Graham Bartlett (Cisco) email us that he presented the weakness of PSK in IKEv2 in several public presentations and in his book.
On August 15th 2018, we were informed by Tamir Zegman that John Pliam described the attack on his web page in 1999.
FAQs
- Do you have a name, logo, any merchandising for the attack?
No. - Have I been attacked?
We mentioned above that such an attack would require an active man-in-the-middle attack. In the logs this could look like a failed connection attempt or a session timed out. But this is a rather weak indication and no evidence for an attack. - What should I do?
If you do not have the option to switch to authentication with digital signatures, choose a Pre-Shared Key that resists dictionary attacks. If you want to achieve e.g. 128 bits of security, configure a PSK with at least 19 random ASCII characters. And do not use something that can be found in public databases. - Am I safe if I use PSKs with IKEv2?
No, interestingly the standard also mentions that IKEv2 does not prevent against off-line dictionary attacks. - Where can I learn more?
You can read the paper. [alternative link to the paper] - What else does the paper contain?
The paper contains a lot more details than this blogpost. It explains all authentication methods of IKEv1 and it gives message flow diagrams of the protocol. There, we describe a variant of the attack that uses the Bleichenbacher oracles to forge signatures to target IKEv2.
- Hacking Tools For Windows 7
- Hacker Tools 2019
- Pentest Tools Url Fuzzer
- Pentest Tools Linux
- Hacking Tools Github
- Hack Tools Mac
- Hack And Tools
- Pentest Tools Alternative
- Hacker Tools Hardware
- Hack Tools For Mac
- Pentest Recon Tools
- Usb Pentest Tools
- Hacker Tools
- Pentest Tools Github
- How To Make Hacking Tools
- Hack Tools
- Hacking Tools Hardware
- Hack Tool Apk No Root
- Hacker Tools Hardware
- Hacker Tools Linux
- Hack Apps
- New Hacker Tools
- What Is Hacking Tools
- Hack And Tools
- Hacking Tools For Windows 7
- Free Pentest Tools For Windows
- Black Hat Hacker Tools
- Hack Tools For Ubuntu
- Hacking Tools Windows
- Pentest Tools Website Vulnerability
- Hacker Tools Free Download
- Tools Used For Hacking
- Hacker Tools Windows
- Pentest Tools Android
- How To Hack
- Hacking Tools For Mac
- New Hacker Tools
- Black Hat Hacker Tools
- Hacking Tools For Windows Free Download
- Hacker
- Hackers Toolbox
- Hacker Tools 2019
- New Hacker Tools
- Pentest Tools Alternative
- Hacker Tools Apk Download
- Pentest Tools List
- Hacker Tools Apk
- Beginner Hacker Tools
- Hacker Tools Github
- Hacker Tools Online
- Github Hacking Tools
- Hacking Tools Download
- Hacking Tools Windows
- Hak5 Tools
- Hack Tools For Games
- Hacker Tool Kit
- Hack Tools For Mac
- Hack Tools For Games
- Hacking Tools Windows
- Pentest Tools Review
- Pentest Tools Online
- What Are Hacking Tools
- Underground Hacker Sites
- How To Install Pentest Tools In Ubuntu
- Best Hacking Tools 2019
- Hacker Tools Github
- Hack Tool Apk
- Hacker Tools Software
- Pentest Tools For Android
- Hacker Tools 2019
- Physical Pentest Tools
- Hacker Search Tools
- Hacker Tools Online
- Hacking Tools
- Hacking Tools Mac
- Pentest Tools Tcp Port Scanner
- Hacking Tools Download
- Hacker Tools 2020
- Tools Used For Hacking
- Pentest Tools For Windows
- Tools For Hacker
- What Are Hacking Tools
- Hacker Security Tools
- Pentest Tools Website
- Hacking Tools For Beginners
- Hack Tools Mac
- Hacker Tools List
- Hack Rom Tools
- What Are Hacking Tools
- Growth Hacker Tools
- Hacking Tools Github
- Pentest Tools Bluekeep
- Hacker Tools 2020
- Black Hat Hacker Tools
- Game Hacking
- Hacking Tools Usb
- Hacker Tools 2020
- Hacker Techniques Tools And Incident Handling
- Hacker Hardware Tools
- Pentest Tools Nmap
- Hacking Tools Download
- What Is Hacking Tools
- Hacking Tools 2019
- Pentest Recon Tools
- Hacker Hardware Tools
- Hak5 Tools
- Easy Hack Tools
- Hacker Hardware Tools
- New Hacker Tools
- Hacking Tools Free Download
- Hacking Tools For Windows
- Pentest Tools For Windows
- Pentest Tools Review
- Pentest Tools Bluekeep
- Hacking Tools Pc
- Pentest Tools Alternative
- Hack And Tools
- Hak5 Tools
- Hacking Tools For Windows Free Download
- Hacker Hardware Tools
- Hack Tools
- Computer Hacker
- Pentest Tools Nmap
- Pentest Tools Github
- Hack Tools Download
- World No 1 Hacker Software
- Hacker Search Tools
- Hack Tool Apk No Root
- Hack Tools
- Pentest Box Tools Download
- Hacking Apps
- New Hacker Tools
- Free Pentest Tools For Windows
- Hacker Tools Mac
- Install Pentest Tools Ubuntu
- Hack Tools For Games
- Pentest Tools For Android
- Pentest Tools Android
- Hacker Tools 2020
- Tools For Hacker
- Hack App
- Hackers Toolbox
- Physical Pentest Tools
- Hacker Tools Software
- Pentest Tools Apk
- Hacking Tools Pc
- Hacks And Tools
- Hacking Tools For Windows 7
- Hacker
- Hacker Tools 2019
- How To Install Pentest Tools In Ubuntu
- Pentest Recon Tools
- Hack Tool Apk No Root
- Game Hacking
- Hacker Tools For Pc
- Hacker Hardware Tools
- Nsa Hacker Tools
- Pentest Automation Tools
- Hack Tools For Ubuntu
- New Hack Tools
- Pentest Automation Tools
- Hacking Tools Kit
- Hacker Tools 2020
- Kik Hack Tools
- Hack Rom Tools
No comments:
Post a Comment