TY - GEN
T1 - Practical realisation and elimination of an ECC-related software bug attack
AU - Brumley, Billy
AU - Barbosa, Manuel
AU - Page, Dan
AU - Vercauteren, Frederik
PY - 2012
Y1 - 2012
N2 - We analyse and exploit implementation features in OpenSSL version 0.9.8g which permit an attack against ECDH-based functionality. The attack, although more general, can recover the entire (static) private key from an associated SSL server via 633 adaptive queries when the NIST curve P-256 is used. One can view it as a software-oriented analogue of the bug attack concept due to Biham et al. and, consequently, as the first bug attack to be successfully applied against a real-world system. In addition to the attack and a posteriori countermeasures, we show that formal verification, while rarely used at present, is a viable means of detecting the features which the attack hinges on. Based on the security implications of the attack and the extra justification posed by the possibility of intentionally incorrect implementations in collaborative software development, we conclude that applying and extending the coverage of formal verification to augment existing test strategies for OpenSSL-like software should be deemed a worthwhile, long-term challenge.
AB - We analyse and exploit implementation features in OpenSSL version 0.9.8g which permit an attack against ECDH-based functionality. The attack, although more general, can recover the entire (static) private key from an associated SSL server via 633 adaptive queries when the NIST curve P-256 is used. One can view it as a software-oriented analogue of the bug attack concept due to Biham et al. and, consequently, as the first bug attack to be successfully applied against a real-world system. In addition to the attack and a posteriori countermeasures, we show that formal verification, while rarely used at present, is a viable means of detecting the features which the attack hinges on. Based on the security implications of the attack and the extra justification posed by the possibility of intentionally incorrect implementations in collaborative software development, we conclude that applying and extending the coverage of formal verification to augment existing test strategies for OpenSSL-like software should be deemed a worthwhile, long-term challenge.
KW - bug attack
KW - Elliptic curve
KW - fault attack
KW - NIST
KW - OpenSSL
UR - http://www.scopus.com/inward/record.url?scp=84857727360&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-27954-6_11
DO - 10.1007/978-3-642-27954-6_11
M3 - Conference contribution
AN - SCOPUS:84857727360
SN - 9783642279539
VL - 7178 LNCS
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 171
EP - 186
BT - Topics in Cryptology, CT-RSA 2012 - The Cryptographers' Track at the RSA Conference 2012, Proceedings
T2 - 12th Cryptographers' Track at the RSA Conference, CT-RSA 2012
Y2 - 27 February 2012 through 2 March 2012
ER -