Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid signature) to a client that still accepts TLS <1.2 and 512-bit DHE to impersonate a server that has since been fixed (disabling DHE and/or TLS <1.2 entirely) or "fixed" (using a larger DH group). TLS 1.2 seems like it would be immune to this attack, since its ServerKeyExchange signature includes the ClientRandom value. is there something i'm missing, or would this actually work?

share|improve this question
    
why is there this link pointing to a flag!? –  SOJPM May 23 at 19:15
    
what link pointing to a flag? –  lily wilson May 23 at 19:16
    
https://hotaru.thinkindifferent.net/flags/x, inserted in your last edit. –  SOJPM May 23 at 19:17
    
oops. apparently i somehow hit 'paste' when i was fixing the fact that my phone put "it's" instead of "its". –  lily wilson May 23 at 19:24
    
short version of the answer: Read the next page of the RFC. –  SOJPM May 23 at 19:31

1 Answer 1

up vote 1 down vote accepted

TLSv1.1 doesn't have a different treatment of the key-exchange parameters than TLSv1.2 has. It's just a little less obvious.

Let's dig into TLSv1.1 specification.
On page 44 you'll find that ServerKeyExchange consists of ServerXXXParams params and Signature signed_params. Now on page 44 you'll actually find a definition of Signature. This definition signs sha_hash with or without md5_hash. Now look at the definition of sha_hash and md5_hash. It states that MD5(ClientHello.random + ServerHello.random + ServerParams) is the definition for md5_hash and that SHA(ClientHello.random + ServerHello.random + ServerParams) is the definition of sha_hash.

Now you've found the random values you're looking for and hence this is the same methodology as in TLSv1.2, but there the signature is directly applied and arbitrary hash-functions can be used.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.