Zerologon question - AES-CFB8

Question

I was reading the zerologon whitepaper by secura named:

Unauthenticated domain controller compromise by subverting Netlogon cryptography.

I'm trying to understand the zerologon attack. The issue is on the KDF function (AES-CF8) that uses a IV with all zeros, I tried to follow the AES implementation with the block mode chosen and my main question is, the secret used on AES encryption is the computer password hash or the server nonce?

My guess is that it's the server nonce else the output of the AES would always be equal. Also, if am I correct, this explains the reason that 256 tries should be needed, because we have 1 possibility in 256 options in one byte (first one). Is it correct?

Also, the document has a figure showing the output of the AES operation with only 8 bytes, however the document state

The basic AES block cipher operation takes an input of 16 bytes and permutes it to an equally-sized output.

The protocol just transfer the last 8? Or transfer everything and he just did it to illustrate?

Answer 1

I guess you are referring to this whitepaper, so I will refer to it in my answer.

First, I think you misunderstood part of the protocol (illustrated in Figure 1): the KDF is not AES-CFB8. A KDF is a Key Derivation Function: in this particular case, it basically acts as a hash function, transforming the inputs into a random-like stream of bytes

We assume the client and server share a secret password (or a secret password hash to be more specific). At the beginning, the send each other a random challenge, and use both challenge and the shared secret to derive a session key, using the KDF. Since we assume the server to be honest, its challenge will be random, making the session key change every session (hence the 256 tries).

AES-CFB8 is only involved after, when they encrypt each other challenge with the session key (to show that they successfully derived the session key, proving they know the shared secret).

So both challenges (nonces) are fed to the KDF, along with the password, which give you a session key. Then AES-CFB8 is used to encrypt the challenge you received, with this sesson key.

---

Considering the 8 bytes long ciphertext, the whitepaper is right. Indeed, raw AES process 16 bytes blocks and output a 16 bytes block. However, CFB8 mode encrypts one byte at a time, by first encrypting the IV (16 bytes, in yellow) and XORing the last byte of the result (in green) with the first byte of plaintext (in blue), and start over shifting the block it encrypt from one byte (see Figure 2). Basically, you will perform a raw AES encryption of one block (so you have the 16 bytes input-output) but you discard 15 bytes of the output (yes, this is a slow way to encrypt).

This means CFB8 make it possible to process a plaintext of arbitrary size $\ell$, without padding anything, and to produce a ciphertext of $\ell$ bytes. Here, the challenges are 8 bytes long, hence the 8 bytes' output!