Published: August 7, 2019 Latest version available from: https://w1.fi/security/2019-6/ This is an update on earlier security advisories 2019-1 and 2019-2. Please see those advisories for more details in the issues. https://w1.fi/security/2019-1/ https://w1.fi/security/2019-2/ Vulnerability hostapd and wpa_supplicant security advisories 2019-1 and 2019-2 addressed side-channel attacks related to SAE and EAP-pwd. The improvements identified in those advisories made it more difficult to observe external differences in timing or memory access to mitigate against this type of attacks. However, the identified changes did not remove all differences. Especially when using ECC groups that use a prime that is not close to a power of two, those improvements were not complete. In practice, use of groups that use Brainpool curves (groups 28-30) are in this category. Additional implementation changes are now available to improve mitigation against potential attacks. While these are expected to improve security of SAE and EAP-pwd in general to some extend, the largest help from these would be to the cases where groups 28-30 are used. However, for those groups, additional changes would likely be needed to make the protection against timing differences be at similar level as it is for other ECC groups. That would result in significantly higher need for CPU and that may not be practical for all devices. As such, the current recommended practice is to disable all use of the Brainpool curves in the context of SAE and EAP-pwd. This does not mean that these curves themselves have issues, but the way the SAE and EAP-pwd derivation of PWE is designed is not convenient for the primes used in these curves. In other words, this has no impact to other uses of the Brainpool curves. The timing differences even when using groups 28-30 are non-trivial to attack in practice, but cannot be ruled impossible. Cache attacks (see advisories 2019-1 and 2019-2 for more details) can still be feasible when using these groups in SAE or EAP-pwd with wpa_supplicant/hostapd v2.8. Vulnerable versions/configurations All wpa_supplicant and hostapd versions with SAE support (CONFIG_SAE=y in the build configuration and SAE with groups 28-30 enabled in the runtime configuration and supported by the used crypto library). Note that the applicable groups are not enabled by default in v2.8 (and in case of wpa_supplicant, in any version) and they would need to be explicitly enabled by adding the group identifies into the sae_groups configuration parameter. All wpa_supplicant and hostapd versions with EAP-pwd support (CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled in the runtime configuration). Note that EAP-pwd server implementation in hostapd enables only a single group at the time (pwd_group parameter) and by default, group 19 is used. As such, this would be applicable only if the pwd_group parameter is set to use one of the groups 28-30. The EAP-pwd peer implementation wpa_supplicant, follows the group selected by the server and as such, it would be vulnerable for the case where an attacker controls the authentication server (e.g., through a rogue AP) if the crypto library supports groups 28-30. As far as crypto library support for Brainpool curves is concerned, OpenSSL 1.0.2 and newer have support for them while BoringSSL does not. Possible mitigation steps - Update to wpa_supplicant/hostapd v2.9 or newer - Merge the following commits to wpa_supplicant/hostapd v2.8 and rebuild: SAE: Use const_time_memcmp() for pwd_value >= prime comparison EAP-pwd: Use const_time_memcmp() for pwd_value >= prime comparison OpenSSL: Use BN_bn2binpad() or BN_bn2bin_padded() if available SAE: Run through prf result processing even if it >= prime EAP-pwd: Run through prf result processing even if it >= prime dragonfly: Disable use of groups using Brainpool curves These patches are available from https://w1.fi/security/2019-6/ -- Jouni Malinen PGP id EFC895FA _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
