1458929 - Timing Vulnerabilities with CBC-Mode Symmetric Decryption Using Padding (primarily NOT in TLS) [MSRC:34097]

Status: RESOLVED DUPLICATE of bug 1459141

(NSS :: Libraries, defect, P1)

Description

[Daniel Veditz [:dveditz]]

Attachment: Symmetric Encryption Guidance-Final.pdf

We received the following from MSRC:

We are reaching out to you to provide awareness that Microsoft will be releasing updated developer guidance to address a Padding Oracle vulnerability in CBC-Mode Symmetric Decryption. The Microsoft documentation focuses on Managed .NET Framework code and Native C++ code; however, we believe that it likely affects other common scripting languages, and so we strongly encourage you to review the attached document and evaluate our findings against your products or unique coding language.

We are currently planning to release a security advisory and our updated developer support content on June 12, 2018 to disclose the vulnerability. Our documentation only discusses this issue in regards to Microsoft’s .NET and C++ implementations, and makes no mention of your products or code language. However, the details could allow a researcher to make additional assumptions on other languages. This issue may also be hardcoded in products and/or services that you maintain, and addressing this issue may require you to update them. 

We anticipate a public disclosure on 2018-06-12 at 10am PST (1pm EST). At that time, Microsoft will publish an advisory and the updated developer guidance will be made publicly  available. We request that you do not discuss this information and do not share it outside of your team until the disclosure date of 2018-06-12. Please consider this this information TLP:AMBER, https://www.us-cert.gov/tlp.*

Comment 1

[Martin Thomson [:mt:]]

This doesn't apply to us.  We're very careful about CBC padding oracles.  See for example https://searchfox.org/nss/rev/07e15231b59638e9babc79d63493eab766d12595/lib/ssl/ssl3con.c#11684

Comment 2

[Frederik Braun [:freddy]]

What does this mean for our Web Crypto support, which includes AES-CBC? :P

Comment 3

[Martin Thomson [:mt:]]

That's a good point.

Our WebCrypto code calls into NSS (the PK11_Decrypt() function), which is responsible for removing padding.  The padding removal there isn't as nearly paranoid as the TLS code, which suggests that it might be wise to look at it more carefully.  I'll open a bug.

Comment 4

[Daniel Veditz [:dveditz]]

Why open a new bug? This paper was not about CBC used in TLS -- It's from MS and they probably assume you're using Windows correctly-coded APIs for TLS. The paper is was talking about CBC used wrongly in other types of applications (explicitly mentions "An application that encrypts and decrypts messages inside the TLS tunnel" and "Note that using TLS alone may not protect you in these scenarios.")

If we're investigating those scenarios then this is not an invalid bug.

Comment 5

[Daniel Veditz [:dveditz]]

We can make this a tracking bug if you've opened others already.

Comment 6

[Martin Thomson [:mt:]]

We don't - to my knowledge - use the APIs mentioned.  However, it did prompt me to check our implementation, and discover a potential problem.  Not sure what to do with this then.  I'll leave that with you.