Saturday, May 27, 2023

Practical Dictionary Attack On IPsec IKE

We found out that in contrast to public knowledge, the Pre-Shared Key (PSK) authentication method in main mode of IKEv1 is susceptible to offline dictionary attacks. This requires only a single active Man-in-the-Middle attack. Thus, if low entropy passwords are used as PSKs, this can easily be broken.

This week at the USENIX Security conference, Dennis Felsch will present our research paper on IPsec attacksThe Dangers of Key Reuse: Practical Attacks on IPsec IKE. [alternative link to the paper]

In his blog post, Dennis showed how to attack the public key encryption based authentication methods of IKEv1 (PKE & RPKE) and how to use this attack against IKEv2 signature based authentication method. In this blog post, I will focus on another interesting finding regarding IKEv1 and the Pre-Shared Key authentication.

IPsec and Internet Key Exchange (IKE)

IPsec enables cryptographic protection of IP packets. It is commonly used to build VPNs (Virtual Private Networks). For key establishment, the IKE protocol is used. IKE exists in two versions, each with different modes, different phases, several authentication methods, and configuration options. Therefore, IKE is one of the most complex cryptographic protocols in use.

In version 1 of IKE (IKEv1), four authentication methods are available for Phase 1, in which initial authenticated keying material is established: Two public key encryption based methods, one signature based method, and a PSK (Pre-Shared Key) based method.

The relationship between IKEv1 Phase 1, Phase 2, and IPsec ESP. Multiple simultaneous Phase 2 connections can be established from a single Phase 1 connection. Grey parts are encrypted, either with IKE derived keys (light grey) or with IPsec keys (dark grey). The numbers at the curly brackets denote the number of messages to be exchanged in the protocol.

Pre-Shared Key authentication

As shown above, Pre-Shared Key authentication is one of three authentication methods in IKEv1. The authentication is based on the knowledge of a shared secret string. In reality, this is probably some sort of password.

The IKEv1 handshake for PSK authentication looks like the following (simplified version):


In the first two messages, the session identifier (inside HDR) and the cryptographic algorithms (proposals) are selected by initiator and responder. 

In messages 3 and 4, they exchange ephemeral Diffie-Hellman shares and nonces. After that, they compute a key k by using their shared secret (PSK) in a PRF function (e.g. HMAC-SHA1) and the previously exchanged nonces. This key is used to derive additional keys (ka, kd, ke). The key kd is used to compute MACI over the session identifier and the shared diffie-hellman secret gxy. Finally, the key ke is used to encrypt IDI (e.g. IPv4 address of the peer) and MACI

Weaknesses of PSK authentication

It is well known that the aggressive mode of authentication in combination with PSK is insecure and vulnerable against off-line dictionary attacks, by simply eavesedropping the packets. For example, in strongSwan it is necessary to set the following configuration flag in order to use it:
charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes

For the main mode, we found a similar attack when doing some minor additional work. For that, the attacker needs to waits until a peer A (initiator) tries to connect to another peer B (responder). Then, the attacker acts as a man-in-the middle and behaves like the peer B would, but does not forward the packets to B.

From the picture above it should be clear that an attacker who acts as B can compute (gxy) and receives the necessary public values session ID, nI, nR. However, the attacker does not know the PSK. In order to mount a dictionary attack against this value, he uses the nonces, and computes a candidate for for every entry in the dictionary. It is necessary to make a key derivation for every k with the values of the session identifiers and shared Diffie-Hellmann secret the possible keys ka, kd and ke. Then, the attacker uses ke in order to decrypt the encrypted part of message 5. Due to IDI often being an IP address plus some additional data of the initiator, the attacker can easily determine if the correct PSK has been found.

Who is affected?

This weakness exists in the IKEv1 standard (RFC 2409). Every software or hardware that is compliant to this standard is affected. Therefore, we encourage all vendors, companies, and developers to at least ensure that high-entropy Pre-Shared Keys are used in IKEv1 configurations.

In order to verify the attack, we tested the attack against strongSWAN 5.5.1.

Proof-of-Concept

We have implemented a PoC that runs a dictionary attack against a network capture (pcapng) of a IKEv1 main mode session. As input, it also requires the Diffie-Hellmann secret as described above. You can find the source code at github. We only tested the attack against strongSWAN 5.5.1. If you want to use the PoC against another implementation or session, you have to adjust the idHex value in main.py.

Responsible Disclosure

We reported our findings to the international CERT at July 6th, 2018. We were informed that they contacted over 250 parties about the weakness. The CVE ID for it is CVE-2018-5389 [cert entry].

Credits

On August 10th, 2018, we learned that this attack against IKEv1 main mode with PSKs was previously described by David McGrew in his blog post Great Cipher, But Where Did You Get That Key?. We would like to point out that neither we nor the USENIX reviewers nor the CERT were obviously aware of this.
On August 14th 2018, Graham Bartlett (Cisco) email us that he presented the weakness of PSK in IKEv2 in several public presentations and in his book.
On August 15th 2018, we were informed by Tamir Zegman that John Pliam described the attack on his web page in 1999.

FAQs

  • Do you have a name, logo, any merchandising for the attack?
    No.
  • Have I been attacked?
    We mentioned above that such an attack would require an active man-in-the-middle attack. In the logs this could look like a failed connection attempt or a session timed out. But this is a rather weak indication and no evidence for an attack. 
  • What should I do?
    If you do not have the option to switch to authentication with digital signatures, choose a Pre-Shared Key that resists dictionary attacks. If you want to achieve e.g. 128 bits of security, configure a PSK with at least 19 random ASCII characters. And do not use something that can be found in public databases.
  • Am I safe if I use PSKs with IKEv2?
    No, interestingly the standard also mentions that IKEv2 does not prevent against off-line dictionary attacks.
  • Where can I learn more?
    You can read the paper[alternative link to the paper]
  • What else does the paper contain?
    The paper contains a lot more details than this blogpost. It explains all authentication methods of IKEv1 and it gives message flow diagrams of the protocol. There, we describe a variant of the attack that uses the Bleichenbacher oracles to forge signatures to target IKEv2. 
Related posts
  1. Hacking Tools For Windows 7
  2. Hacker Tools 2019
  3. Pentest Tools Url Fuzzer
  4. Pentest Tools Linux
  5. Hacking Tools Github
  6. Hack Tools Mac
  7. Hack And Tools
  8. Pentest Tools Alternative
  9. Hacker Tools Hardware
  10. Hack Tools For Mac
  11. Pentest Recon Tools
  12. Usb Pentest Tools
  13. Hacker Tools
  14. Pentest Tools Github
  15. How To Make Hacking Tools
  16. Hack Tools
  17. Hacking Tools Hardware
  18. Hack Tool Apk No Root
  19. Hacker Tools Hardware
  20. Hacker Tools Linux
  21. Hack Apps
  22. New Hacker Tools
  23. What Is Hacking Tools
  24. Hack And Tools
  25. Hacking Tools For Windows 7
  26. Free Pentest Tools For Windows
  27. Black Hat Hacker Tools
  28. Hack Tools For Ubuntu
  29. Hacking Tools Windows
  30. Pentest Tools Website Vulnerability
  31. Hacker Tools Free Download
  32. Tools Used For Hacking
  33. Hacker Tools Windows
  34. Pentest Tools Android
  35. How To Hack
  36. Hacking Tools For Mac
  37. New Hacker Tools
  38. Black Hat Hacker Tools
  39. Hacking Tools For Windows Free Download
  40. Hacker
  41. Hackers Toolbox
  42. Hacker Tools 2019
  43. New Hacker Tools
  44. Pentest Tools Alternative
  45. Hacker Tools Apk Download
  46. Pentest Tools List
  47. Hacker Tools Apk
  48. Beginner Hacker Tools
  49. Hacker Tools Github
  50. Hacker Tools Online
  51. Github Hacking Tools
  52. Hacking Tools Download
  53. Hacking Tools Windows
  54. Hak5 Tools
  55. Hack Tools For Games
  56. Hacker Tool Kit
  57. Hack Tools For Mac
  58. Hack Tools For Games
  59. Hacking Tools Windows
  60. Pentest Tools Review
  61. Pentest Tools Online
  62. What Are Hacking Tools
  63. Underground Hacker Sites
  64. How To Install Pentest Tools In Ubuntu
  65. Best Hacking Tools 2019
  66. Hacker Tools Github
  67. Hack Tool Apk
  68. Hacker Tools Software
  69. Pentest Tools For Android
  70. Hacker Tools 2019
  71. Physical Pentest Tools
  72. Hacker Search Tools
  73. Hacker Tools Online
  74. Hacking Tools
  75. Hacking Tools Mac
  76. Pentest Tools Tcp Port Scanner
  77. Hacking Tools Download
  78. Hacker Tools 2020
  79. Tools Used For Hacking
  80. Pentest Tools For Windows
  81. Tools For Hacker
  82. What Are Hacking Tools
  83. Hacker Security Tools
  84. Pentest Tools Website
  85. Hacking Tools For Beginners
  86. Hack Tools Mac
  87. Hacker Tools List
  88. Hack Rom Tools
  89. What Are Hacking Tools
  90. Growth Hacker Tools
  91. Hacking Tools Github
  92. Pentest Tools Bluekeep
  93. Hacker Tools 2020
  94. Black Hat Hacker Tools
  95. Game Hacking
  96. Hacking Tools Usb
  97. Hacker Tools 2020
  98. Hacker Techniques Tools And Incident Handling
  99. Hacker Hardware Tools
  100. Pentest Tools Nmap
  101. Hacking Tools Download
  102. What Is Hacking Tools
  103. Hacking Tools 2019
  104. Pentest Recon Tools
  105. Hacker Hardware Tools
  106. Hak5 Tools
  107. Easy Hack Tools
  108. Hacker Hardware Tools
  109. New Hacker Tools
  110. Hacking Tools Free Download
  111. Hacking Tools For Windows
  112. Pentest Tools For Windows
  113. Pentest Tools Review
  114. Pentest Tools Bluekeep
  115. Hacking Tools Pc
  116. Pentest Tools Alternative
  117. Hack And Tools
  118. Hak5 Tools
  119. Hacking Tools For Windows Free Download
  120. Hacker Hardware Tools
  121. Hack Tools
  122. Computer Hacker
  123. Pentest Tools Nmap
  124. Pentest Tools Github
  125. Hack Tools Download
  126. World No 1 Hacker Software
  127. Hacker Search Tools
  128. Hack Tool Apk No Root
  129. Hack Tools
  130. Pentest Box Tools Download
  131. Hacking Apps
  132. New Hacker Tools
  133. Free Pentest Tools For Windows
  134. Hacker Tools Mac
  135. Install Pentest Tools Ubuntu
  136. Hack Tools For Games
  137. Pentest Tools For Android
  138. Pentest Tools Android
  139. Hacker Tools 2020
  140. Tools For Hacker
  141. Hack App
  142. Hackers Toolbox
  143. Physical Pentest Tools
  144. Hacker Tools Software
  145. Pentest Tools Apk
  146. Hacking Tools Pc
  147. Hacks And Tools
  148. Hacking Tools For Windows 7
  149. Hacker
  150. Hacker Tools 2019
  151. How To Install Pentest Tools In Ubuntu
  152. Pentest Recon Tools
  153. Hack Tool Apk No Root
  154. Game Hacking
  155. Hacker Tools For Pc
  156. Hacker Hardware Tools
  157. Nsa Hacker Tools
  158. Pentest Automation Tools
  159. Hack Tools For Ubuntu
  160. New Hack Tools
  161. Pentest Automation Tools
  162. Hacking Tools Kit
  163. Hacker Tools 2020
  164. Kik Hack Tools
  165. Hack Rom Tools

No comments:

Post a Comment