Bug in OpenSSL allows attackers to decrypt HTTPS traffic

Maintainers of the OpenSSL cryptographic code library have fixed a high-severity vulnerability that made it possible for attackers to obtain the key that decrypts communications secured in HTTPS and other transport layer security channels.

While the potential impact is high, the vulnerability can be exploited only when a variety of conditions are met. First, it's present only in OpenSSL version 1.0.2. Applications that rely on it must use groups based on the digital signature algorithm to generate ephemeral keys based on the Diffie Hellman key exchange. By default, servers that do this will reuse the same private Diffie-Hellman exponent for the life of the server process, and that makes them vulnerable to the key-recovery attack. DSA-based Diffie-Hellman configurations that rely on a static Diffie-Hellman ciphersuite are also susceptible.

Fortunately, the requirements don't appear to be met by many mainstream applications that rely on OpenSSL and use DSA-based Diffie-Hellman. The Apache Web server, for instance, turns on the SSL_OP_SINGLE_DH_USE option, which causes different private exponents to be used. The OpenSSL-derived BoringSSL code library, meanwhile, got rid of SSL_OP_SINGLE_DH_USE support a few months ago, and LibreSSL deprecated it earlier this week. The applications and libraries may still be vulnerable when using a static ciphersuite, however.

When the edge conditions are met, attackers can send a large number of handshake requests to a vulnerable server or end-user computer. When enough calculations are completed, the attacker can obtain partial secret values and combine the results with the Chinese remainder theorem to eventually deduce the decryption key. For a much more technical description of the vulnerability, which is indexed as CVE-2016-0701, see this blog post published Thursday by Antonio Sanso, the Adobe Systems researcher who discovered and privately reported it. OpenSSL officials have additional details here. Among other things, the OpenSSL advisory warns that the fix may compromise performance.

Also See: Alert:This Link Will Reboot Your iOS Device Within 30 Seconds

The time it took OpenSSL maintainers to fix the flaw is impressive. Sanso said he reported the bug on January 12. That means it took just over two weeks for the maintainers to complete and distribute a fix. Interestingly, when the researcher reported the vulnerability, the fix preventing the reuse of Diffie-Hellman exponents had already been committed, but it was not yet made available for release. The completion of the partial fix may have contributed to the speed of the patch release.

Remember Logjam?

Thursday's release also contained additional hardening against an HTTPS-crippling vulnerability that threatened tens of thousands of servers when it was first disclosed last May. Dubbed Logjam, it allowed attackers to downgrade Diffie-Hellman-generated encrypted connections to use extremely weak 512-bit key material. From there, attackers could use pre-computed data prepared ahead of time to deduce the key negotiated between the two parties.

OpenSSL will now reject all key negotiations with Diffie-Hellman parameters shorter than 1,024 bits. A previous OpenSSL patch had increased the limit to 768 bits.

People using OpenSSL version 1.0.2 should upgrade to 1.0.2f, while those still using version 1.0.1 should install 1.0.1r. Thursday's OpenSSL advisory also reminded users that support for version 1.0.1 will end at the end of this year, after which no security fixes will be available. Support for versions 0.9.8 and 1.0.0 ended in December.