CVE-2024-28834 - Minerva Attack Cryptographic Vulnerability in GnuTLS: Timing Side-channel Exploit Possibility

Overview
A critical flaw has been recently discovered in the GnuTLS library, categorized under CVE-2024-28834. This vulnerability, known as the Minerva attack, is a result of cryptographic deterministic behavior when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag. While this behavior is meant to improve the efficiency of cryptographic operations, it potentially exposes a timing side-channel that could be exploited by an attacker. In this post, we will delve into the details of this vulnerability, its code snippet, the possible exploit, and how to mitigate this issue.

Background

GnuTLS is a widely used open-source library that provides cryptographic functionality to a variety of applications, including web servers and various Internet of Things (IoT) devices. The Minerva attack vulnerability exposes the deterministic nature of these cryptographic systems, leading to potential attacks through timing side-channels. For a deeper understanding of Minerva attack and its implications, refer to the original research by the Centre for Cyber Security Research and Innovation: Minerva Attack White Paper

Vulnerability Details

The Minerva attack on GnuTLS specifically stems from the use of the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag during generating deterministic ECDSA (Elliptic Curve Digital Signature Algorithm) and DSA (Digital Signature Algorithm) signatures. The issue arises when a nonce is generated with varying bit lengths, such as 513 or 512 bits. The following code snippet shows the part of the GnuTLS library code where the vulnerability exists:

/* GnuTLS library ECDSA/DSA signature generation */
int _gnutls_dsa_sign(ecdsa_params_t *params, const gnutls_datum_t *data,
              gnutls_datum_t *signature, int use_fast)
{
  // ...
  // Generate nonce: k = rfc6979_k(...)
  // ...
  
  if (use_fast) {
    // Use GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE
    // ...
  } else {
    // Generate k, the nonce, with 513 or 512 bits
    // ...
  }

  // Perform ECDSA/DSA signature generation
  // ...
}

When this flag is used, the nonce size experiences a noticeable step down from 513 bits to 512 bits. This creates a timing side-channel, which, in specific scenarios, might be exploited by an attacker to recover the private key used for signing.

Exploit Details

An attacker capable of carefully measuring the time it takes to generate an ECDSA or DSA signature with the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag enabled may exploit this vulnerability. Those measurements can potentially enable the attacker to identify the exact size of the nonce used for signing and gradually recover the private key.

Note that this attack is deemed highly complex and requires the attacker to have a deep understanding of cryptographic systems and the ability to measure timing differences in the order of nanoseconds accurately. Hence, the practical risk for most GnuTLS deployments might be considered low.

Mitigation

Users and developers who rely on the GnuTLS library should update their systems to the latest version as it incorporates a fix that effectively mitigates this vulnerability. The GnuTLS development team has modified the nonce generation process, ensuring that any potential timing side-channels are effectively protected, rendering exploitation attempts futile.

Conclusion

CVE-2024-28834 - the Minerva attack vulnerability in the GnuTLS library - is a critical flaw that should be closely monitored and mitigated as soon as possible. While the potential risk of exploitation is deemed low, the impact on affected systems could be severe if the private keys used for signing are recovered.

By updating the GnuTLS library to the latest version, developers and users alike can ensure the security and stability of their cryptographic operations, reducing the risk of exploitation and maintaining the confidentiality of crucial cryptographic components.

Timeline

Published on: 03/21/2024 14:15:07 UTC
Last modified on: 04/18/2024 05:15:48 UTC