Cargando…
Extracting the Secrets of OpenSSL with RAMBleed
Concomitant with the increasing density of semiconductors, various attacks that threaten the integrity and security of dynamic random access memory (DRAM) have been devised. Among these, a side-channel attack called RAMBleed is a prolific one that utilizes a general user-level account without specia...
Autores principales: | , , , , , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
MDPI
2022
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9103224/ https://www.ncbi.nlm.nih.gov/pubmed/35591276 http://dx.doi.org/10.3390/s22093586 |
_version_ | 1784707510759849984 |
---|---|
author | Tomita, Chihiro Takita, Makoto Fukushima, Kazuhide Nakano, Yuto Shiraishi, Yoshiaki Morii, Masakatu |
author_facet | Tomita, Chihiro Takita, Makoto Fukushima, Kazuhide Nakano, Yuto Shiraishi, Yoshiaki Morii, Masakatu |
author_sort | Tomita, Chihiro |
collection | PubMed |
description | Concomitant with the increasing density of semiconductors, various attacks that threaten the integrity and security of dynamic random access memory (DRAM) have been devised. Among these, a side-channel attack called RAMBleed is a prolific one that utilizes a general user-level account without special rights to read secret information. Studies have reported that it can be used to obtain OpenSSH secret keys. However, a technique for deriving the Rivest–Shamir–Adleman (RSA) secret keys used in OpenSSL under realistic parameters and environments has not been reported. We propose a method that uses RAMBleed to obtain OpenSSL secret keys and demonstrate its efficacy using the example of an Apache server. The proposed method exploits the fact that, in the operation of an Apache server that uses OpenSSL, the RSA private keys are deployed on DRAM at a set time. Although the result of reading this secret information contains a few errors, error-free secret information is obtainable when it is used with RSA cryptanalysis techniques. We performed a series of attacks incorporating RAMBleed and eventually retrieved the OpenSSL RSA private key, indicating that secret information is obtainable with high probability. The proposed method can easily and externally be executed without administrator privileges on a server using DRAM that is vulnerable to RAMBleed, showing that RAMBleed is also a major threat to OpenSSL. |
format | Online Article Text |
id | pubmed-9103224 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2022 |
publisher | MDPI |
record_format | MEDLINE/PubMed |
spelling | pubmed-91032242022-05-14 Extracting the Secrets of OpenSSL with RAMBleed Tomita, Chihiro Takita, Makoto Fukushima, Kazuhide Nakano, Yuto Shiraishi, Yoshiaki Morii, Masakatu Sensors (Basel) Article Concomitant with the increasing density of semiconductors, various attacks that threaten the integrity and security of dynamic random access memory (DRAM) have been devised. Among these, a side-channel attack called RAMBleed is a prolific one that utilizes a general user-level account without special rights to read secret information. Studies have reported that it can be used to obtain OpenSSH secret keys. However, a technique for deriving the Rivest–Shamir–Adleman (RSA) secret keys used in OpenSSL under realistic parameters and environments has not been reported. We propose a method that uses RAMBleed to obtain OpenSSL secret keys and demonstrate its efficacy using the example of an Apache server. The proposed method exploits the fact that, in the operation of an Apache server that uses OpenSSL, the RSA private keys are deployed on DRAM at a set time. Although the result of reading this secret information contains a few errors, error-free secret information is obtainable when it is used with RSA cryptanalysis techniques. We performed a series of attacks incorporating RAMBleed and eventually retrieved the OpenSSL RSA private key, indicating that secret information is obtainable with high probability. The proposed method can easily and externally be executed without administrator privileges on a server using DRAM that is vulnerable to RAMBleed, showing that RAMBleed is also a major threat to OpenSSL. MDPI 2022-05-09 /pmc/articles/PMC9103224/ /pubmed/35591276 http://dx.doi.org/10.3390/s22093586 Text en © 2022 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/). |
spellingShingle | Article Tomita, Chihiro Takita, Makoto Fukushima, Kazuhide Nakano, Yuto Shiraishi, Yoshiaki Morii, Masakatu Extracting the Secrets of OpenSSL with RAMBleed |
title | Extracting the Secrets of OpenSSL with RAMBleed |
title_full | Extracting the Secrets of OpenSSL with RAMBleed |
title_fullStr | Extracting the Secrets of OpenSSL with RAMBleed |
title_full_unstemmed | Extracting the Secrets of OpenSSL with RAMBleed |
title_short | Extracting the Secrets of OpenSSL with RAMBleed |
title_sort | extracting the secrets of openssl with rambleed |
topic | Article |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9103224/ https://www.ncbi.nlm.nih.gov/pubmed/35591276 http://dx.doi.org/10.3390/s22093586 |
work_keys_str_mv | AT tomitachihiro extractingthesecretsofopensslwithrambleed AT takitamakoto extractingthesecretsofopensslwithrambleed AT fukushimakazuhide extractingthesecretsofopensslwithrambleed AT nakanoyuto extractingthesecretsofopensslwithrambleed AT shiraishiyoshiaki extractingthesecretsofopensslwithrambleed AT moriimasakatu extractingthesecretsofopensslwithrambleed |