Cryptography In The Web: The Case Of Cryptographic Design .

3y ago
370.83 KB
9 Pages
Last View : 2d ago
Last Download : 4m ago
Upload by : Xander Jaffe

2011 IEEE Symposium on Security and PrivacyCryptography in the Web: The Case of Cryptographic Design Flaws in ASP.NETJuliano RizzoNetiferaBuenos Aires, Argentinajuliano@netifera.comThai DuongVnsecurity/HVAOnlineHo Chi Minh City, Vietnamthaidn@vnsecurity.netcryptographic errors together make the Web become a goldmine for chosen-ciphertext attacks.Abstract—This paper discusses how cryptography is misusedin the security design of a large part of the Web. Our focusis on ASP.NET, the web application framework developedby Microsoft that powers 25% of all Internet web sites. Weshow that attackers can abuse multiple cryptographic designflaws to compromise ASP.NET web applications. We describepractical and highly efficient attacks that allow attackers tosteal cryptographic secret keys and forge authentication tokensto access sensitive information. The attacks combine decryptionoracles, unauthenticated encryptions, and the reuse of keys fordifferent encryption purposes. Finally, we give some reasonswhy cryptography is often misused in web technologies, andrecommend steps to avoid these mistakes.In this paper, we illustrate this point by examining the caseof cryptographic implementations in web applications basedon ASP.NET [12]. The framework was first released inJanuary 2002 with version 1.0 of the .NET Framework. Asof September 2010, it is believed that 25% of all the Internetweb sites are developed using ASP.NET.1 Here we reviewASP.NET v4.0, which was the current stable version at thetime of submission. Our comments also apply to severalprevious versions of ASP.NET.Keywords-Cryptography, Application Security, Web security,Decryption oracle attack, Unauthenticated encryption.We observe several cryptographic flaws in ASP.NET v4.0.The most serious flaw (which turns out to have been presentin ASP.NET for almost three years) is a consequence ofunauthenticated encryption. We present two practical andhighly efficient attacks that allow attackers to steal cryptographic secret keys, forge authentication tokens and destroythe security model of every ASP.NET v4.0 application.Both are chosen-ciphertext attacks that combine decryptionoracles similar to the padding oracle introduced by Vaudenayat EuroCrypt ’02 [13] and the CBC-R technique that Rizzoand Duong demonstrated at USENIX WOOT ’10 [14]. Thenovelty of these attacks is that not only can the attackerdecrypt secret data in ASP.NET, but he also can createciphertexts that after being decrypted and processed byASP.NET, allow him to retrieve sensitive information.I. I NTRODUCTIONAt EuroCrypt 2004 Nguyen asked, “How can one know ifwhat is implemented [in software] is good cryptography?”[1]. This is an important question because history has shownthat cryptography is often used incorrectly in both opensource and proprietary software (see [1]–[7]). Nevertheless,despite the important role of the WWW, there is limitedresearch available from both the cryptographic and websecurity communities to answer Nguyen’s question for thecase of cryptographic implementations in web technologies.This paper shows that badly implemented cryptography isnot limited to traditional software, but is highly pervasive inweb applications as well. Since HTTP is a stateless protocol,web developers must either manage the user session statedata on the server or push it to the client. For performanceand scalability reasons, web developers tend to go withthe latter method. They want to keep session informationsecret, so they correctly turn to cryptography. However,implementing crypto is error-prone. We observe that unauthenticated encryption is often used to encrypt session statedata such as HTTP cookies and view states. Unauthenticatedencryption is dangerous [7]–[11], particularly when used inan authentication system. The ability to forge a ciphertextthat decrypts to a desired plaintext allows the attacker toimpersonate other users easily [7]. Web developers also tendto use the same keys for different encryption purposes. These1081-6011/11 CopyrightUnrecognized 26.00 2011InformationIEEEDOI 10.1109/SP.2011.42The rest of the paper is organized as follows. In Section II,we give an overview of ASP.NET v4.0 and the cryptographicvulnerabilities in the framework. In Section III, we providesufficient background on decryption oracle attacks and theCBC-R technique to make the paper self-contained. InSection IV, we describe our first attack exploiting paddingoracles in the framework. In Section V, we describe oursecond attack, which is faster than the first attack and doesnot require a padding oracle. In Section VI, we consider thepractical impact of our attacks as well as countermeasuresthat prevent them. Our reflections on why cryptography isoften misused in web technologies and our recommendationscan be found in Section VII.1 See481

creating a page for the site’s administrators to manage theuser accounts; and so forth. Prior to ASP.NET, developershad to decide how to implement all of these features ontheir own. To ease this burden, ASP.NET introduced theconcept of forms-based authentication. This feature providesa FormsAuthentication class that handles signing inand out of a site, as well as a protected authentication ticketto remember users’ login states across page requests.II. A N OVERVIEW OF ASP.NETIn this section, we review some key concepts and terminology for ASP.NET. We then describe how the frameworkmisuses cryptography when attempting to tamper-proof andencrypt sensitive information.A. Key Concepts and TerminologyMachine Key: The machine key is a pair of global secret keys set in the web application configuration to beused for encryption and authentication. A key namedvalidationKey is used to generate hashed messageauthentication codes (HMAC) to protect the integrity ofauthentication tickets and view states. A second key nameddecryptionKey is used to encrypt and decrypt authentication tickets and view states.Forms authentication uses an authentication ticket thatis created when a user logs on to a site; thisticket is then used to track the user throughout thesite. The forms authentication ticket is created by theFormsAuthentication class as follows. Once the useris validated, the FormsAuthentication class internally createsa FormsAuthenticationTicket object by specifyinghis username; the version of the ticket; the directory path;the issue date of the ticket; the expiration date of the ticket;whether the ticket should be persisted; and, optionally, userdefined data. Next the FormsAuthenticationTicketobject is serialized, then an HMAC is generated from theserialized data using the validationKey. This HMACis appended to the end of the serialized data, then thewhole content is encrypted using AES or DES with thedecryptionKey. The resulting string is called the formauthentication ticket, and it is usually contained insidean HTTP cookie. However, ASP.NET supports cookie-lessforms authentication; in this case the ticket is passed in aquery string.View State: An ASP.NET application is a collection of .NETpages, known officially as “web forms”. ASP.NET applications are hosted by a web server and are accessed usingthe stateless HTTP protocol. As such, if an application usesstateful interaction, it has to implement state managementon its own. ASP.NET provides various functions for statemanagement, and view state is one of them.View state refers to the page-level state management mechanism utilized by the HTML pages emitted by ASP.NETapplications to maintain the state of the web form controlsand widgets. The state of the controls is sent to the serverat every form submission in a hidden field known asVIEWSTATE. The main use for this is to preserve forminformation when the page is reloaded. The hidden field isupdated by the server and is never modified by the client.Each time a subsequent request is received after authentication, the FormsAuthenticationModule class retrievesthe authentication ticket from the authentication cookie orthe query string, decrypts it, computes the hash value, andverifies the HMAC value to ensure that the ticket has notbeen tampered with. Finally, the expiration time containedinside of the forms authentication ticket is verified. If allchecks pass, ASP.NET will authenticate the request, andthe user is authenticated as the username contained in theauthentication ticket. Consequently, the ability to createvalid authentication tickets is sufficient for an attacker toimpersonate any user account in ASP.NET applications.By default, the validationKey is used to generate anHMAC from the view state content. This HMAC is storedas a hidden field in ASP.NET forms, and is verified onevery request. If ASP.NET receives a request with an invalidHMAC, the request is dropped. Because the view statecan contain sensitive data, ASP.NET allows developers toenable view state encryption on a server-wide or per-pagebasis. Microsoft’s documentation on view state encryptionis unclear as to whether the view state is still authenticatedif encryption is enabled.2 Based on our testing, we see thatASP.NET v4.0 either authenticates or encrypts view states,but it does not apply both operations at the same time.Web Resources and Script Resources: In the .NET framework, an assembly is a compiled code library used fordeployment, versioning and security. An assembly consistsof one ore more files. These files can be code modules,web resources (e.g., HTML, CSS, or images), or scriptresources (e.g., Javascript). Web developers reference thesestatic resources through a standard API.Forms Authentication Tickets: Since ASP.NET aims to become a rapid web development framework, it provides builtin solutions for many common problems in web development. One of them is user account support. Providinguser account support for any site involves the same setof steps: creating a datastore, a login page and a registerpage; defining authentication and authorization mechanisms;2 SeeWeb and script resources rely on special handlers namedWebResource.axd and ScriptResource.axd, respectively, to serve resources to the web browser. When arequest comes in from the client for WebResource.axd,the handler looks for the web resource identifier in 8.aspx.482

QueryString method of the Request object. Based onthe value of the web resource identifier, the handler thentries to load the assembly that contains this resource. If thisoperation is successful, the handler will then look for theassembly attribute and load the resource stream from theassembly. Finally, the handler will obtain the data from theresource stream and send it to the client together with thecontent type specified in the assembly not uncommon to see users generating their keys usingonline tools. Websites to generate cryptographic keys arepopular amongst ASP.NET developers and users.3Improper Use of Cryptographic Primitives: There are twoissues in the way ASP.NET uses cryptography.First, the cryptographic API in ASP.NET does not useauthenticated encryption by default. In Section II-A, weshowed that web resources and script resources identifiersare encrypted without authentication.The request format for both WebResource.axd andScriptResource.axd is as follows:Secondly, the framework uses the MAC-then-Encrypt modefor authenticated encryption. As previous work has demonstrated, this mode is vulnerable to chosen-ciphertext attacks[9], [15], [16].WebResource.axd?d encrypted id&t timestampWe observe two interesting things about the d parameter:1) ASP.NET encrypts this parameter, but does not authenticate the ciphertext.2) Due to a feature in ScriptResource.axd, anattacker can download arbitrary files inside the document root of ASP.NET applications given a validencrypted d parameter.III. D ECRYPTION O RACLE ATTACKSIn this section, we discuss decryption oracle attacks and theCBC-R technique. In this and subsequent sections, we followthe notation described in Section 4 of [17]. It is important tostress that the padding oracle is just one kind of decryptionoracle, and we have found decryption oracles that are easierand faster to exploit in ASP.NET. We illustrate this point inSection V.B. Cryptographic Design Flaws in ASP.NETWe observe two sets of cryptographic flaws in ASP.NET:improper use of cryptographic primitives, and insecure keymanagement.A. The Padding Oracle AttackInsecure Key Management: There are three issues in howASP.NET manages cryptographic keys.The padding oracle attack was first introduced by Vaudenayat EuroCrypt ’02 [13]. As explained in Paterson and Yau’ssummary [18], the padding oracle attack requires an oraclethat, on receipt of a ciphertext, decrypts it and replies tothe sender whether the padding is valid or invalid. Theattack works under the assumption that the attackers canintercept padded messages encrypted in CBC mode and haveaccess to the aforementioned padding oracle. The result isthat attackers can recover the plaintext corresponding to anyblock of ciphertext using an average of 128 b oracle calls,where b is the number of bytes in a block.The first issue is the reuse of keys for different purposes.In the last section, we showed that the framework usescryptography to authenticate and encrypt view states, formsauthentication tickets, web resources and script resources.These are pieces of information with different levels ofimportance. Forms authentication tickets and view statesare critical to the security of ASP.NET, but web resourcesand script resources identifiers do not include very sensitiveinformation. ASP.NET, however, encrypts all of them withthe same cryptographic keys.1) Padding Oracles In ASP.NET: There are several paddingoracles in default components of the framework. They are allapplication independent, (i.e. they exist in every ASP.NETapplication). We divide them into two different sets:The second issue is insecure key storage. By default,plaintext cryptographic keys are stored in a file namedweb.config in the document root of ASP.NET applications. In other words, all it takes to steal these keys in anyASP.NET application is one file disclosure.1) Authenticated encryption padding oracles: as discussed in Section II, ASP.NET uses the MAC-thenEncrypt mode to protect form authentication tickets.Since this mode is vulnerable to chosen-ciphertextattacks, we have a padding oracle here. Beside formsauthentication tickets, ASP.NET also uses MAC-thenEncrypt for role cookies and anonymous identificationthat can also be used as padding oracles.4The last issue is that key management is left to developersand users. Since ASP.NET provides no easy way to generateor revoke keys, users tend not to change keys during thelifetime of an application. Furthermore, it is sometimesimpossible to change keys because they are used to encryptimportant information that is needed by the applications tooperate properly. Users also typically don’t change defaultkeys in applications downloaded from the Internet or installed by a third party. When forced to generate keys, it3 See4 px.

2) Unauthenticated encryption padding oracles: as notedin Section II, ASP.NET encrypts the references toscript and web resources, but it does not protectthe produced ciphertext with an authentication code.This introduces additional padding oracles into theframework. We will use them in our attacks describedin Section IV and Section V.Although we are going to describe more powerful attacksin this paper, attackers can use these padding oracles todecrypt and obtain secrets from view states, form authentication tickets, and other encrypted information in ASP.NETapplications.Figure 1.B. Turning Decryption Oracles into Encryption OraclesIn this section, we review CBC-R, a technique to turn adecryption oracle into an encryption oracle. First introducedby Rizzo and Duong [14], this technique is importantbecause it allows attackers to create valid ciphertexts thatare trusted by the target. When a system assumes that ameaningful meassage obtained from the decryption of someciphertext implies a trusted origin of it, the CBC-R techniqueallows attackers to create arbitrary ciphertexts to abuse thesystem.Algorithm 1 CBC-R.1) Choose a plaintext message P , pad the message,and divide it into n blocks of b bytes denoted byP1 , P2 , . . . , Pn .2) Pick a few random bytes r1 , r2 , . . . , rb , and set Cn r1 r2 . . . rb .3) For i n down to 1:Ci 1 Pi O(Ci )4) Set IV C0 .5) Output IV and C C1 . . . Cn .1) CBC-R: The CBC mode is defined as follows:CBC Encryption:C1 CIP HK (P1 IV );Ci CIP HK (Pi Ci 1 )he can correct by inserting a new ciphertext block Ci 3 .By repeating this operation, he can efficiently encrypt acomplete message block by block, starting from the last one.Since the first block of the CBC ciphertext stream dependson the IV, if the attacker can set the IV, then the decrypteddata will be exactly what he wants without any garbledblocks. If the attacker doesn’t control the IV, then the firstblock is garbled. For an overview of this process, refer toAlgorithm 1.for i 2,.,n.CBC Decryption: 1P1 CIP HK(C1 ) IV ; 1Pi CIP HK(Ci ) Ci 1CBC-R.for i 2,.,n.CBC-R turns a CBC decryption oracle into a CBC encryption oracle. The process is simple. First, the attacker choosesa random ciphertext block Ci . He then sends Ci to thedecryption oracle O to get its intermediate plaintext. Since2) CBC-R Without Controlling IV: We have shown thatCBC-R allows the attacker to encrypt any message. But,if he cannot set the IV, then the first plaintext block will berandom and meaningless. If the victim expects the decryptedmessage to start with a standard header, and the attackerdoesn’t control the IV, then the victim will ignore the forgedmessage constructed by CBC-R. This is what happens withthe resource identifiers in ASP.NET, where the first twocharacters of the decrypted identifiers must be in the limitedset of defined options. We have found two workarounds.Pi O(Ci ) Ci 1and the attacker can change Ci 1 , he can make Pi equal toany arbitrary value. Suppose he wants to make Pi equal tosome Px . Then, all he needs to do is to setCi 1 Px O(Ci ).But does this make Ci 1 decrypt to a garbled block Pi 1 ?Yes, but the attacker can fix Pi 1 by sending Ci 1 to thedecryption oracle to get its intermediate plaintext, and setUsing Captured Ciphertexts as Prefix: If the attacker captures a ciphertext whose plaintext is a valid message, then hecan prepend the ciphertext to his CBC-R encrypted messageCi 2 Pi 1 O(Ci 1 ).Now, the attacker has two consecutive plaintext blocks Pi 1and Pi of his choice, and a leading garbled block Pi 2 that484

root directory of ASP.NET applications. Downloading theweb.config file is the best first step for an attacker. Thisfile is present in most applications and contains importantsecrets, including the keys necessary to forge authenticationtickets and database passwords.Algorithm 2 Brute-forcing C1 .1) Choose a plaintext message P , pad the message,and divide it into n blocks of b bytes, denote themP1 , P2 , . . . , Pn where P1 Pheader P1 .2) UseCBC-RandtheoracletobuildCn , . . . , C2 , C1 so that C1 C2 . . . Cn decryptsto Pgarbage P2 P3 . . . Pn .3) Pick a few random bytes r1 , r2 , . . . , rb , and set C1 r1 r2 . . . rb .4) TestifC1 C2 . . . CndecryptstoPheader Pgarbage P3 P4 . . . Pn . If not, go backto step 3.5) Output C C1 C2 . . . Cn .In order to download files, the attacker has to craft a dparameter that decrypts to a string with the following formatR#anything /path/to/fileThe first two bytes can be one of these four values r#,R#, q#, and Q#. This is a perfect application for CBCR. The attacker can use the method of Section III-B2and Algorithm 2 to construct d with a three block message so that the last two blocks will be decrypted toga

ASP.NET v4.0 either authenticates or encrypts view states, but it does not apply both operations at the same time. Forms Authentication Tickets: Since ASP.NET aims to be-come a rapid web development framework, it provides built-in solutions for many common problems in web devel-opment. One of them is user account support. Providing user account support for any site involves the same set of .

Related Documents:

May 02, 2018 · D. Program Evaluation ͟The organization has provided a description of the framework for how each program will be evaluated. The framework should include all the elements below: ͟The evaluation methods are cost-effective for the organization ͟Quantitative and qualitative data is being collected (at Basics tier, data collection must have begun)

Silat is a combative art of self-defense and survival rooted from Matay archipelago. It was traced at thé early of Langkasuka Kingdom (2nd century CE) till thé reign of Melaka (Malaysia) Sultanate era (13th century). Silat has now evolved to become part of social culture and tradition with thé appearance of a fine physical and spiritual .

Dr. Sunita Bharatwal** Dr. Pawan Garga*** Abstract Customer satisfaction is derived from thè functionalities and values, a product or Service can provide. The current study aims to segregate thè dimensions of ordine Service quality and gather insights on its impact on web shopping. The trends of purchases have

On an exceptional basis, Member States may request UNESCO to provide thé candidates with access to thé platform so they can complète thé form by themselves. Thèse requests must be addressed to esd rize unesco. or by 15 A ril 2021 UNESCO will provide thé nomineewith accessto thé platform via their émail address.

̶The leading indicator of employee engagement is based on the quality of the relationship between employee and supervisor Empower your managers! ̶Help them understand the impact on the organization ̶Share important changes, plan options, tasks, and deadlines ̶Provide key messages and talking points ̶Prepare them to answer employee questions

Chính Văn.- Còn đức Thế tôn thì tuệ giác cực kỳ trong sạch 8: hiện hành bất nhị 9, đạt đến vô tướng 10, đứng vào chỗ đứng của các đức Thế tôn 11, thể hiện tính bình đẳng của các Ngài, đến chỗ không còn chướng ngại 12, giáo pháp không thể khuynh đảo, tâm thức không bị cản trở, cái được

of public-key cryptography; providing hands-on experience with some of the most common encryption algorithms that are used on the internet today. Modern Cryptography Introduction Outline 1 Introduction 2 Historical Cryptography Caesar Cipher 3 Public{Key Cryptography

Cryptography with DNA binary strands and so on. In terms of DNA algorithms, there are such results as A DNA-based, bimolecular cryptography design, Public-key system using DNA as a one-way function for key distribution, DNASC cryptography system and so on. However, DNA cryptography is an