[Tanel]

Eesti asjatundjad kinnitavad, et paanikaks pole põhjust ja ID-kaarti pole lahti murtud.

Loe edasi Eesti Päevalehest.

[neros]

Oot... kas kellelgi on äkki link artiklile selle vana ründe kohta? Puhtalt huvi pärast isegi loeks. Hetkel igatahes ei näe mille pärast kisa tõstetakse. Pangarööv toimuks spetsialistide poolt 15-30ne reaalse minutiga, ehk paneme juba profülaktika mõttes pangad ka kinni?

[mihkelv]

http://hal.inria.fr/docs/00/69/19/58/PDF/RR-7944.pdf seda on vist mõeldud.

[soomer]

Vastused Eesti spetsialistidelt:
(Peeter Laud ja Helger Lippmaa)


Hi,

the paper presents a speed-up to Bleichenbacher's attack from CRYPTO 1998.
The attack shows that given access to an oracle O that:
*. Receives as input an RSA ciphertext
*. Answers whether the corresponding plaintext is formatted according to
PKCS #1 v1.5 padding rules;
one can build an oracle O' that decrypts / signs with the same RSA secret
key that O is using (note that O' will not output the secret key itself).
However, one invocation of O' requires a rather large (but in certain
contexts, realistic) number of invocations of O. In the current paper, the
required number of invocations is lowered, but it is still somewhat more
than "a couple of".

The attack can be used in situations where the circumstances hand you
(the attacker) the oracle O, but not the much stronger oracle O'. In these
situations, there are demonstrations that the attack works in practice and
constructs the oracle O'.

For the Estonian ID-card, we cannot imagine such situations where the
attacker has access to O, but not to O'. Hence I think that CERT.EE's
reaction has been fully adequate. To get access to oracle O, to make the
ID-card tell you whether a message has been correctly padded, you have to
tell it to decrypt that message. If some malware in the computer to which
the ID-card is attached to wants to make the decryption query, it must
submit PIN1 to the card, too. If the malware running in that computer
knows PIN1, then it already has access to O'.

Can an outside attacker obtain access to the oracle O, where the secret
key is in you ID-card? If you are using the ID-card to authenticate
yourself to the internet banking server and the likes, then it can't
because in this case, your ID-card does not decrypt anything. Rather, it
signs a message, but this is not what oracle O is about. The attacker may
get access to oracle O if you receive an encrypted document that you have
to decrypt with your ID-card. As far as I know, ID-cards are not
significantly used like this. Also, this would give the attacker a much
lower query rate to O than a malware would have.

Still, I think that the ideas to have the following functionality in
ID-card has been a bad idea:
*. both signing and decrypting with the authentication key;
*. support of PKCS #1 v1.5.
However, for now, nothing has changed. As before, when you're not using
your ID-card, do not keep it connected to your computer.

Cheers,
Peeter

On Wed, 6 Jun 2012, Helger Lipmaa wrote:

> Such a paper:
>
> Title: Efficient Padding Oracle Attacks on Cryptographic Hardware
> Authors: Romain Bardou, Riccardo Focard, Yusuke Kawamoto, Lorenzo
> Simionato, Graham Steel, Joe-Kai Tsay
> URL: http://hal.inria.fr/docs/00/69/19/58/PDF/RR-7944.pdf
>
> was accepted to CRYPTO 2012. In particular, it also attacks the
> Estonian ID card. Details are given in Section 3.3: it takes about 27
> hours to decrypt an arbitrary valid ciphertext, and 103 hours to forge
> a signature. This in the case your card has been given out in 2011 or
> later (uses a 2048-bit key), if it has been given out earlier and uses
> a 1024-bit key, decrypting and forging will take less time.
>
> What is interesting is Appendix 3 of the pdf file given above, that
> states the manifacturers' responses. While everybody else promised to
> correct mistakes in their products, the Estonian Certification
> Authority (Sertifitseerimiskeskus) will not. I will copy that
> paragraph here:
>
> We have recently led a vulnerability report of our attack on the Estonian
> eID card to the Estonian Certication Center. They showed concern
> about the vulnerability of the card we reported and informed CERT
> Estonia about the flaw. However, according to the Estonian Certication
> Center the authentication certicate is mainly used for authentication with
> SSL (in 95% of the cases), and our attack would be too slow to forge an
> SSL client response before a server timeout. At the time of our
> communication they had not decided on any countermeasures.
>
> Estonia, is like always, singled out in such issues. Until the flaw is
> fixed, I do recommend to either revoke signing certificates (like I
> did as soon as I got my card!), or at least check that you know where
> your ID card is at least once per 27 hours. If it's lost, somebody may
> be breaking it at the very moment.
>
> Helger



Mina loen sellest välja, et ära mingil juhul jätta ID kaarti lugejasse pärast kui oled PIN1 sisestanud, ning ära jäta seda ka lugejasse muudel juhtudel. Isegi kui oled jätnud võtab see 27 tundi, ning rohkem, kui su arvuti on aeglane.

Aga seda on alati soovitatud.

[iFlop]

Kas ma saan õigesti aru, et rünnak on võimalik ainult siis, kui ründaja teab PIN1/PIN2 koodi?

[DVDRW]

Endal selline tähelepanek, et vahest pole sisenemisel ja maksmisel PINi vajagi panna
Siis kui ühekorra pandud. Seega arvutit ei tohi kunagi jätta üksi ID kaart sees.
Varsti tulevad müügile sellised lugejad kus sisestad PINi lugeja küljes olevalt numbriklaviatuurilt ja ongi keyloggeril vesi peal

[Betamax]

See tähendabki, et sessioon pole lõpetatud, enne kui brauseri kinni paned või kaardi välja võtad. Seepärast netipangast või ostukeskkonnast väljalogimisel hoiatatakse-soovitatakse, et nüüd pange brauser kinni või paneme ise brauseri kinni.

[WäntWõll]

[Sold OUT]

[iFlop]

Kas on tõesti nii, et kui sisenen id-kaaridga x-lehele, siis on võimalik ID kaardi abil ka y-lehele siseneda ilma et PINi küsitakse?

[DVDRW]

Tean inimest kes oma ID kaardi läpakasse pani ja väljaulatuva osa ära murdis, et siis ei peaks seda igakord uuesti panema

[Sold OUT]

[iFlop]

carlking, aga mingi timeout on ju ikka olemas? Sama sessiooni näiteks nädalateks vast püsti ei jäeta?

[Sold OUT]

No netipangas on selleks vist 10-15 minutit. Tõenäoliselt mingite turvastandardite järgi.

[strohher]

[Sold OUT]

[strohher]

carlking, mugavam on passi kaasas tassida kui ID kaarti rahakoti vahel?

[WäntWõll]

[Dirty Harry]

[PitBull]

[tahanteada]

Viimase aja üsna levinud moevärk on igatahes see, et ID-kaart vedeleb päevade-kuude viisi ID-lugejas ning isiku-dokumendina on kaasas autojuhiluba.

[LKits]

[Sold OUT]

[LKits]

Ka ID-kaardi kiibi/andmekandja sees toimub pidev andmete muutumine?
Kas ID-kaardi toorel (RAW data) kujul kloonida polegi siis võimalik?

[Tanel]