Zerologon question - AES-CFB8

I was reading the zerologon whitepaper by secura named:

Unauthenticated domain controller compromise by subverting Netlogon cryptography.

I'm trying to understand the zerologon attack. The issue is on the KDF function (AES-CF8) that uses a IV with all zeros, I tried to follow the AES implementation with the block mode chosen and my main question is, the secret used on AES encryption is the computer password hash or the server nonce?

My guess is that it's the server nonce else the output of the AES would always be equal. Also, if am I correct, this explains the reason that 256 tries should be needed, because we have 1 possibility in 256 options in one byte (first one). Is it correct?

Also, the document has a figure showing the output of the AES operation with only 8 bytes, however the document state

The basic AES block cipher operation takes an input of 16 bytes and permutes it to an equally-sized output.

The protocol just transfer the last 8? Or transfer everything and he just did it to illustrate?

1 Answer

I guess you are referring to this whitepaper, so I will refer to it in my answer.

First, I think you misunderstood part of the protocol (illustrated in Figure 1): the KDF is not AES-CFB8. A KDF is a Key Derivation Function: in this particular case, it basically acts as a hash function, transforming the inputs into a random-like stream of bytes

We assume the client and server share a secret password (or a secret password hash to be more specific). At the beginning, the send each other a random challenge, and use both challenge and the shared secret to derive a session key, using the KDF. Since we assume the server to be honest, its challenge will be random, making the session key change every session (hence the 256 tries).

AES-CFB8 is only involved after, when they encrypt each other challenge with the session key (to show that they successfully derived the session key, proving they know the shared secret).

So both challenges (nonces) are fed to the KDF, along with the password, which give you a session key. Then AES-CFB8 is used to encrypt the challenge you received, with this sesson key.

Considering the 8 bytes long ciphertext, the whitepaper is right. Indeed, raw AES process 16 bytes blocks and output a 16 bytes block. However, CFB8 mode encrypts one byte at a time, by first encrypting the IV (16 bytes, in yellow) and XORing the last byte of the result (in green) with the first byte of plaintext (in blue), and start over shifting the block it encrypt from one byte (see Figure 2). Basically, you will perform a raw AES encryption of one block (so you have the 16 bytes input-output) but you discard 15 bytes of the output (yes, this is a slow way to encrypt).

This means CFB8 make it possible to process a plaintext of arbitrary size $$\ell$$, without padding anything, and to produce a ciphertext of $$\ell$$ bytes. Here, the challenges are 8 bytes long, hence the 8 bytes' output!

• Thanks for explanation Faulst. I think that a few things are clear. I understand the difference between AES and KDF. But what is the KDF algorithm? My question about the key is on the AES-CFB8. It uses 16 byte NULL IV + 8 byte controlled attacker byte (client challenge). But what is the AES-CFB8 key used in each AES-CFB8 operation from server traffic to client? KDF, right? If i'm correct we have to try in general 255 to find a collision of the AES-CFB8 with the KDF as key that produce a zero output on the first byte, right? I mean, since we can't control the KDF output. – albfrk99 Nov 16 '20 at 18:06
• So AES-CFB8 could take 2, 3 or 5 bytes input and output just 2, 4 and 5 bytes as output? it's weird. I my dumb brain the output blocks were supposed to be fixed. – albfrk99 Nov 16 '20 at 18:08
• Thanks for your time in explain, really appreciate. – albfrk99 Nov 16 '20 at 18:09
• @albfrk99 The particular KDF used in Netlogon (when AES is choosed for encryption) is HMAC-SHA256. The key used with AES-CFB8 is indeed the output of the KDF, so you have the right intuition regarding the 255 trials. For AES-CFB8, it's quite a particular mode indeed, which may be counter intuitive at first. You must keep in mind that it works with 16 bytes block internally, but discard 15 bytes of the output every time, that's why you can have an arbitrary number of bytes in the input/output. – Faulst Nov 16 '20 at 20:19
• However, you don't want the key to start with 0, but the first encrypted block, which happens with a 1/256 probability when encrypting the same data (the fixed IV) with a random key. If the first encrypted block starts with a zero byte, Then your first byte of cipher text will be 00 XOR 00 = 00 (first 00 is from the encrypted block, the other one comes from challenge you chosed). Then when you shift the block you encrypt, you will still encrypt a null block, and the first byte of the encrypted block will be 00, and so on. – Faulst Nov 16 '20 at 20:29