I was reading the zerologon whitepaper by secura named:
Unauthenticated domain controller compromise by subverting Netlogon cryptography.
I'm trying to understand the zerologon attack. The issue is on the KDF function (AES-CF8) that uses a IV with all zeros, I tried to follow the AES implementation with the block mode chosen and my main question is, the secret used on AES encryption is the computer password hash or the server nonce?
My guess is that it's the server nonce else the output of the AES would always be equal. Also, if am I correct, this explains the reason that 256 tries should be needed, because we have 1 possibility in 256 options in one byte (first one). Is it correct?
Also, the document has a figure showing the output of the AES operation with only 8 bytes, however the document state
The basic AES block cipher operation takes an input of 16 bytes and permutes it to an equally-sized output.
The protocol just transfer the last 8? Or transfer everything and he just did it to illustrate?