Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Encryption Security Open Source Your Rights Online

Socat Weak Crypto Draws Suspicions Of a Backdoor (threatpost.com) 50

Posted by timothy from the giving-away-our-best-tricks dept.
msm1267 writes: Socat is the latest open source tool to come under suspicion that it is backdoored. A security advisory published Monday warned that the OpenSSL address implementation in Socat contains a hard-coded Diffie-Hellman 1024-bit prime number that was not prime. "The effective cryptographic strength of a key exchange using these parameters was weaker than the one one could get by using a prime p," the advisory said. "Moreover, since there is no indication of how these parameters were chosen, the existence of a trapdoor that makes possible for an eavesdropper to recover the shared secret from a key exchange that uses them cannot be ruled out." Socat said it has generated a new prime that is 2048 bits long; versions 1.7.3.0 and 2.0.0-b8 are affected. The advisory adds that a temporary workaround would be to disable the Diffie-Hellman ciphers.
This discussion has been archived. No new comments can be posted.

Socat Weak Crypto Draws Suspicions Of a Backdoor More

Socat Weak Crypto Draws Suspicions Of a Backdoor

Comments Filter:

  • There seem to be a lot of these backdoors (Score:2, Insightful)

    by Anonymous Coward

    Putting on my tin-foil hat, it almost seems like there is a coordinated program to backdoor security products, and attribute them to a 'mistake'. But that's just me being paranoid.

    • Re:There seem to be a lot of these backdoors (Score:5, Insightful)

      by gstoddart ( 321705 ) on Tuesday February 02, 2016 @05:35PM (#51424321) Homepage

      Putting on my tin-foil hat, it almost seems like there is a coordinated program to backdoor security products, and attribute them to a 'mistake'. But that's just me being paranoid.

      In fairness, intentionally weakening crypto requires as much understanding of it as doing it right.

      Screwing it up, however, can be done by any moron.

      Which happened here? Who the hell knows.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        > Which happened here? Who the hell knows.

        Oh please.

        You're probably trying to do the "it's just incompetence, not malice" thing.

        But after seeing this pattern over and over.. no, it reeks of manipulation.

        Any advanced malice is indistinguishable from incompetence.

      • Re:There seem to be a lot of these backdoors (Score:4, Interesting)

        by arglebargle_xiv ( 2212710 ) on Tuesday February 02, 2016 @08:19PM (#51425599)

        Given that it also used 512-bit primes [repo.or.cz], which are toy keys that were weak twenty years ago, it's more likely a screwup. Seeing messed-up crypto written by people whose crypto knowledge extends to reading the Wikipedia page on RSA and perhaps one or two chapters of Applied Cryptography is pretty much par for the course.

        From a very brief Google of socat howtos, I couldn't see much about enabling or applying checking of certs, which means it probably doesn't do that either. In addition the advisory is pretty confusing, what does "OpenSSL address implementation" mean? Since the server supplies the DH values and OpenSSL itself has known-good DH values, why is there some other value hardcoded into socat?

      • In fairness, intentionally weakening crypto requires as much understanding of it as doing it right.

        In this case, all it would have needed is understanding that it's important that the numbers used to generate the keys are prime and that substituting a composite number would make the keys easier to find. I'm not claiming that this is what happened, but it's not something that only a cryptography specialist could have come up with.

    • Putting on my tin-foil hat, it almost seems like there is a coordinated program to backdoor security products, and attribute them to a 'mistake'. But that's just me being paranoid.

      speaking of which, did you ever check your tin-foil hat for backdoors?

  • This cannot happen accidentally (Score:5, Insightful)

    by JoshuaZ ( 1134087 ) on Tuesday February 02, 2016 @05:33PM (#51424303) Homepage
    This cannot happen accidentally. We have for example versions of the Miller-Rabin test https://en.wikipedia.org/wiki/Miller%E2%80%93Rabin_primality_test [wikipedia.org] which easily test primality if you believe the Riemann Hypothesis and other versions which unconditionally give such a high probability that one is more likely to have had a cosmic ray wreck your computing results than for the test to be erroneous. You can use for example this Javascript http://www.javascripter.net/math/primes/millerrabinprimalitytest.htm [javascripter.net]. There's no obvious way one would come up with a composite number unless one was deliberately trying. Hopefully there's enough of a record to note when this fake prime was put in.

    • Re:This cannot happen accidentally (Score:5, Funny)

      by Anonymous Coward on Tuesday February 02, 2016 @05:37PM (#51424357)

      This evening I'll reflect on your rant while performing the Miller-Coors test

    • Re:This cannot happen accidentally (Score:5, Informative)

      by JoshuaZ ( 1134087 ) on Tuesday February 02, 2016 @05:43PM (#51424421) Homepage
      Followup: acording to this thread https://news.ycombinator.com/item?id=11014175 [ycombinator.com] the number in question fails at even being a pseudoprime for small bases, which means that even the most simple checks were not done. That thread also mentions the individual responsible for giving the "prime"- I'm not sure why he's not being grilled pretty heavily right now.

      • I'm not sure why he's not being grilled pretty heavily right now.

        Because 99% of the time, the process is to blame, not the person.

        • Do we know the process that generated this number, and how it didn't include apparently minimal verification?

          • While your at it, check to see if the numbers within the number can actually make a prime. What I mean is 457 is a prime but 475 isn't. So could it be a matter of a digit being transposed?

    • Re:This cannot happen accidentally (Score:4, Informative)

      by Pseudonym ( 62607 ) on Tuesday February 02, 2016 @06:48PM (#51424989)

      It easily can happen accidentally. The probability of a bug in your implementation of the Miller-Rabin test (for a general "you") is quite high.

      Now look at the history here. The patch was submitted by someone who admitted "I don't have enough knowledge to implement the merge" [xenproject.org], and was accepted without any serious review. Looking at my own history of screwing up commits, it's fairly easy to see how this might have happened.

      I'm just lucky that none of mine had implications that serious. There but for the grace of His Noodly Appendage...

      • Re: (Score:2)

        by Dwedit ( 232252 )

        I was once in computer security class, and my miller-rabin primality test ended up calling an even number prime. I can totally see these failures happening.

    • A note in the commit indicates that Socat was not working in FIPS mode because it requires a 1024 Diffie-Hellman prime, and added that a developer named Zhiang Wang provided a patch with the new prime. The poster revealed that Wang works at Oracle and contributes to Socat.

      accidental or malicious, Mr. Wang is about to have a very bad day.

    • Yes it can. I get asked to do audits of crypto code and see stuff like this all over the place. You mention things like the Miller-Rabin test (I kinda like Frobenius myself) and the extended Riemann Hypothesis when the guy who wrote the code/made the change probably didn't get any further than using Google and copying the result from the first hit he found on Stackexchange, which copied it from somewhere else and got the endianness wrong or something (hmm, must find a machine with Mathematica and feed it

  • Technical discussion (Score:3)

    by bill_mcgonigle ( 4333 ) * on Tuesday February 02, 2016 @05:49PM (#51424481) Homepage Journal

    link [ycombinator.com] to the technical discussion from the article (which propeller heads may safely skip).

  • what is the length of the smallest prime factor of this "prime". the length of the smallest prime factor would determine the actual strength of the encryption.

  • Let's use the proper terminology (Score:4, Informative)

    by pjcreath ( 513472 ) on Tuesday February 02, 2016 @06:20PM (#51424805)
    The correct term for this is backhole [slashdot.org].

  • They can neither confirm nor deny, nor admit electronically or in print, that they have been backdoored.

    Even if it's obvious (and a requirement) that they are.

  • Socat Weak Crypto Draws Suspicions Of a Backdoor

    I thought we were calling them "backholes" now?

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close