New issue
Advanced search Search tips

Issue 814319 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: TLS implementations may disclose side channel information (ROBOT attacks)

Reported by nathanb@lenovo-chrome.com, Feb 21 2018

Issue description

As described in CWE-203: Information Exposure Through Discrepancy, TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding, and may therefore be vulnerable to Bleichenbacher-style attacks. These are also called ROBOT attacks.

Impact 
A remote, unauthenticated attacker may be able to obtain the TLS pre-master secret (TLS session key) and decrypt TLS traffic.

Solution 
Disable TLS RSA 
Affected users and system administrators are encouraged to disable TLS RSA cyphers if possible. Please refer to your product's documentation or contact the vendor's customer service. 

I need to understand:
1. Is Chrome OS naturally vulnerable to this attack
2. If so, has this issue been addressed (by disabling TLS RSA cyphers or some other remediation)
 
Components: Internals>Network>SSL
Have you tried simply visiting, e.g. https://www.ssllabs.com/ssltest/viewMyClient.html from a ChromeOS device?
Cc: davidben@chromium.org
RSA decryption is obsolete and any site which does not enable a more modern option is insecure and must be fixed. Alas, that covers much of the web. Lovely as it would be to disable RSA decryption on the client, that is not even remotely practical right now. No major clients disable RSA decryption ciphers today.

However, ROBOT is about servers, not clients. CrOS is a client, not a server.

What matters is if the server both enables it and fails to implement the mitigations correctly. That server then exposes an RSA private key oracle, whether or not clients happen to use it or not. That oracle may be used for decryption OR signing, affecting clients that disable RSA decryption too. (The attack is certainly much more practical for RSA decryption as it can be carried out offline, but if you're only worried about offline attacks, you can also lean on downgrade protection to force more modern cipher suites with servers that support it.)

So, no, this attack is not directly applicable for CrOS. (Where CrOS does have miscellaneous server components, it would use Chrome's BoringSSL or the copy of OpenSSL the CrOS folks, both of which implement the Bleichenbacher mitigations, implemented in part by yours truly.)
Status: WontFix (was: Unconfirmed)
Thanks for the comments in #3.
Thanks for the help and the expert analysis!
Project Member

Comment 6 by sheriffbot@chromium.org, May 31 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment