If exploited, these flaws can allow attackers to gain unauthorized access to sensitive information or generally cause problems
A few days ago, news broke that a team of researchers from the University of California, San Diego, had demonstrated the ability to recreate RSA host private keys from an SSH server by passively analyzing SSH traffic.
The published research show that when digital signatures are used based on algorithm RSA in SSH, ties them togetherthats that use the Lattice method (Fault Attack) all with recreate la key private RSA are suitable all with digital signatures in /// de a leak de with or hardware during the signature calculation process. The essence of the method is that al compare correct and incorrect RSA digital signatures, you can determine the greatest common divider, thus generating a of the prime numbers used all with generate la key.
RSA encryption is based on the exponentiation operation of a large number, while the public key contains the modulus and degree. The module is formed from two random prime numbers, which only the owner of the private key knows. The attack can be applied to RSA implementations using the Chinese remainder theorem and deterministic padding schemes such as PKCS#1 v1.5.
An attack can be carried out on servers where, due to a combination of circumstances or actions by the attacker, errors occur during the calculation of the digital signature when establishing an SSH connection. These errors can be software-related (incorrect execution of mathematical operations, memory corruption) or hardware-related (errors in the operation of NVRAM and DRAM, or failures during power outages).
One way to induce failures could be through RowHammer attacks , which, among other things, allow for the distortion of individual memory bits during intensive cyclic readings of neighboring memory cells, either remotely or by processing JavaScript code in a browser . Another way to cause failures could be by exploiting vulnerabilities that lead to buffer overflows and data corruption involving keys in memory.
To carry out an attack, one simply needs to passively monitor legitimate connections to the SSH server until a faulty digital signature is identified in the traffic. This signature can then be used to reconstruct the RSA private key. After recreating the host's RSA key, an attacker can use a man-in-the-middle (MITM) attack to silently redirect requests to a fake host impersonating a compromised SSH server and intercept the data transmitted to it.
By examining a collection of intercepted network data that included approximately 5200 billion records associated with the use of the SSH protocol, researchers identified approximately 3200 billion public host keys and digital signatures used during the negotiation of SSH sessions. Of these, 1.200 billion (39,1%) were generated using the RSA algorithm.
The group of researchers mentions that:
In 593671 cases (0,048%) the RSA signature was corrupted and could not be verified, while for 4962 failed signatures, we were able to use the Lattice factorization method to determine the private key from the known public key, resulting in reconstructing 189 unique RSA key pairs (in many cases, the same failed keys and devices were used to generate different corrupted signatures). It took approximately 26 CPU hours to recreate the keys.
The problem only affects specific implementations of the SSH protocol, primarily used on embedded devices. It's also noted that OpenSSH is unaffected because it uses the OpenSSL (or LibreSSL) library to generate keys, which has been protected against vulnerability attacks since 2001.
Additionally, in OpenSSH, the ssh-rsa digital signature scheme (based on sha1) has been deprecated since 2020 and disabled in version 8.8 (support for the rsa-sha2-256 and rsa-sha2-512 schemes remains). The attack could potentially be applicable to the IPsec protocol, but the researchers did not have enough experimental data to confirm such an attack in practice.
Finally, if you are interested in learning more, you can find the details at the following link.