- How does the new attack work in top level?
Even over the years, numerous mitigation techniques are deployed, they showed that some implementations are still vulnerable to various microarchitectural side channels.
They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a vulnerable server. With this, they showed the feasibility of using those Cache-like attacks.
Although the timeout of the browser limits the attack, they were able to parallelize the attack by using TLS servers that share the same public key certificate.
The attacker requires 3 capabilities:
- Side channel capability: attacker must be able to execute code on the victim machine to mount microarchitectural side channel attack
- Privileged Network Position Capability: The attacker must be in the man-in-the middle position so that padding oracle attack with the private key can be exploited.
- Decryption Capability: The attacker needs an ability to start decryption of ciphertext chosen by him on the target system.
A concrete scenario of the attack:
- A physical device shared between a TLS server and the attacker's virtual machine. This requires a determined adversary.
- Second and third can be achieved by the controlling a node between the server and client.
- Which TLS implementations are affected?
They tested the following implementations:
- Amazon s2n
- Apple CoreTLS
- Mozilla NSS
All, except the BearSSL and BoringSSL are affected by their attack.
- How one can mitigate from the attack?
- The backward compatibility is the main issue of this attack. TLS 1.3 security doesn't help you if your server can be downgraded to an earlier version.
- Deprecate the RSA key-exchange.
- Certificate Separation: Don't use the same key for singing and RSA-key exchange.
- Constant-Time Code and Safe API as in BearSLL and BoringSSL API.
- Using Large RSA Keys. The attack requires $\approx \log N$ oracle calls. Use larger keys $>2048$-bits to make the attack less practical.
- Reduce the TLS Handshake Timeouts in order to make MitM attack harder.
- Use BearSSL or BoringSSL