|
 |
109a78 |
From 3ea2a5a026e73d81cd9a3e9bbd4300c433004bfa Mon Sep 17 00:00:00 2001
|
|
|
109a78 |
From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
|
|
|
109a78 |
Date: Wed, 5 Jun 2019 19:21:06 +0000
|
|
|
109a78 |
Subject: [PATCH] EAP-pwd: fix side-channel leak where 1 in 2018 handshakes
|
|
|
109a78 |
fail
|
|
|
109a78 |
|
|
|
109a78 |
Previously the Hunting and Pecking algorithm of EAP-pwd aborted when
|
|
|
109a78 |
more than 10 iterations are needed. Every iteration has a 50% chance
|
|
|
109a78 |
of finding the password element. This means one in every 2048 handshakes
|
|
|
109a78 |
will fail, in which case an error frame is sent to the client. This
|
|
|
109a78 |
event leaks information that can be abused in an offline password
|
|
|
109a78 |
brute-force attack. More precisely, the adversary learns that all 10
|
|
|
109a78 |
iterations failed for the given random EAP-pwd token. Using the same
|
|
|
109a78 |
techniques as in the Dragonblood attack, this can be used to brute-force
|
|
|
109a78 |
the password.
|
|
|
109a78 |
|
|
|
109a78 |
This patch fixes the above issue by executing enough iterations such that
|
|
|
109a78 |
the password element is always found eventually.
|
|
|
109a78 |
|
|
|
109a78 |
Note that timing and cache leaks remain a risk against the current
|
|
|
109a78 |
implementation of EAP-pwd.
|
|
|
109a78 |
---
|
|
|
109a78 |
src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c | 2 +-
|
|
|
109a78 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
109a78 |
|
|
|
109a78 |
diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
109a78 |
index c54f08c030..d94851c3aa 100644
|
|
|
109a78 |
--- a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
109a78 |
+++ b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
109a78 |
@@ -192,7 +192,7 @@ int compute_password_element (pwd_session_t *session, uint16_t grp_num,
|
|
|
109a78 |
}
|
|
|
109a78 |
ctr = 0;
|
|
|
109a78 |
while (1) {
|
|
|
109a78 |
- if (ctr > 10) {
|
|
|
109a78 |
+ if (ctr > 100) {
|
|
|
109a78 |
DEBUG("unable to find random point on curve for group %d, something's fishy", grp_num);
|
|
|
109a78 |
goto fail;
|
|
|
109a78 |
}
|