Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-1C948FD3-DAC0-11E9-81B2-0011D823EEBD: Mbed TLS -- Side channel attack on deterministic ECDSA

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

FreeBSD: VID-1C948FD3-DAC0-11E9-81B2-0011D823EEBD: Mbed TLS -- Side channel attack on deterministic ECDSA

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
09/06/2019
Created
09/21/2019
Added
09/19/2019
Modified
09/19/2019

Description

Janos Follath reports:

Mbed TLS does not have a constant-time/constant-trace arithmetic

library and uses blinding to protect against side channel

attacks.

In the ECDSA signature routine previous Mbed TLS versions used the

same RNG object for generating the ephemeral key pair and for

generating the blinding values. The deterministic ECDSA function

reused this by passing the RNG object created from the private key

and the message to be signed as prescribed by RFC 6979. This meant

that the same RNG object was used whenever the same message was

signed, rendering the blinding ineffective.

If the victim can be tricked to sign the same message repeatedly,

the private key may be recoverable through side channels.

Solution(s)

  • freebsd-upgrade-package-mbedtls

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;