Users login

Create an account »

JOIN XATRIX

Users login

Home » Security Advisories» NetBSD » AES-XCBC-MAC algorithm incorrect key

AES-XCBC-MAC algorithm incorrect key

Machines using IPsec [RFC2401] with AH and AES-XCBC-MAC algorithm [RFC3566] incorrectly used a fixed key instead of the provided one. Because a known key is used, affected Security Associations lack integrity and data origin authentication protection, and an attacker could send forged packets which would be accepted by the receiver.

  • Vendor: NetBSD
  • Vendor ID: 2005-007
  • Date: November 08, 2005


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


NetBSD Security Advisory 2005-007
=================================

Topic: AES-XCBC-MAC (IPsec AH) calculated using fixed key

Version: NetBSD-current: source prior to July 28, 2005
NetBSD 2.1: not affected
NetBSD 2.0.3: not affected
NetBSD 2.0.2: affected
NetBSD 2.0: affected
NetBSD 1.6.*: unaffected

Severity: Affected SAs lack integrity protection so an attacker
can forge data and have it be wrongly accepted

Fixed: NetBSD-current: July 28, 2005
NetBSD-3 branch: July 28, 2005
(3.0 will include the fix)
NetBSD-2.0 branch: July 28, 2005
(2.0.3 includes the fix)
NetBSD-2 branch: July 28, 2005
(2.1 includes the fix)


Abstract
========

Machines using IPsec [RFC2401] with AH and AES-XCBC-MAC algorithm
[RFC3566] incorrectly used a fixed key instead of the provided one.
Because a known key is used, affected Security Associations lack
integrity and data origin authentication protection, and an attacker
could send forged packets which would be accepted by the receiver.


Technical Details
=================

An error in the implementation of the AES-XCBC-MAC algorithm, used by
IPsec SAs for authentication, did not encrypt r_k1s in
ah_aes_xcbc_mac_init(), and only seeded it with the constant in
k1seed.

r_k1s was later passed as the encryption key to rijndaelEncrypt() by
ah_aes_xcbc_mac_loop() and ah_aes_xcbc_mac_result(), causing them to
use the same encryption key for authentication, without using the
key (set by the admin) passed from userland.

Because of this error, a receiving system using AH with AES-XCBC-MAC
checks an IPsec datagram with a fixed and known key. An attacker
could create a forged packet with a valid Integrity Check Value,
causing the receiver to accept the packet. Also, systems with this
bug would not interoperate with systems with the correct key.

If AH with AES-XCBC-MAC is used without confidentiality protection
(e.g. ESP [RFC2406]), an attacker can trivially cause data of his
choice to be received and processed. With confidentiality protection,
causing particular data to be processed is harder, but note that in
general confidentiality mechanisms do not provide effective integrity
protection.


Solutions and Workarounds
=========================

A workaround is to not use the AES-XCBC-MAC algorithm for authentication,
but it is highly recommended that any users of affected NetBSD versions
upgrade their kernel.

The following instructions describe how to upgrade your kernel by
updating your source tree and rebuilding and installing a new version of
the kernel.

* NetBSD-current:

Systems running NetBSD-current dated from before 2005-07-28
should be upgraded to NetBSD-current dated 2005-07-29 or later.
(Systems built from the netbsd-3 branch should be upgraded to
2005-07-29 or later.)

The following files need to be updated from the
netbsd-current CVS branch (aka HEAD):
src/sys/netinet6/ah_aesxcbcmac.c

To update from CVS, re-build, and re-install the kernel:
# cd src
# cvs update -d -P sys/netinet6/ah_aesxcbcmac.c
# ./build.sh kernel=GENERIC
# mv /netbsd /netbsd.old
# cp sys/arch/`machine`/compile/obj/GENERIC/netbsd /netbsd
# shutdown -r now


* NetBSD 2.x:

Systems built from source along the netbsd-2 or netbsd-2-0 branches
dated from before 2005-07-28 should be upgraded from sources dated
2005-07-29 or later. This includes the binary distributions of
NetBSD 2.0 and NetBSD 2.0.2.

NetBSD 2.1 includes the fix.

The following files should be updated from CVS:
src/sys/netinet6/ah_aesxcbcmac.c

To update from CVS, verify that your sources are from the correct
branch, re-build, and re-install the kernel:

# cd src
# cvs update -d -P sys/netinet6/ah_aesxcbcmac.c
# ./build.sh kernel=GENERIC
# mv /netbsd /netbsd.old
# cp sys/arch/`machine`/compile/obj/GENERIC/netbsd /netbsd
# shutdown -r now


* NetBSD 1.6 (and subsequent point releases) do not include
AES-XCBC-MAC and are thus unaffected.


Thanks To
=========

Yukiyo Akisada for reporting the bug to KAME.
SUZUKI Shinsuike for reporting the bug to NetBSD.
Christos Zoulas for quickly adapting the fix to NetBSD.


Revision History
================

2005-10-31 Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2005-007.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2005, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2005-007.txt,v 1.8 2005/10/31 06:41:04 gendalia Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (NetBSD)

iQCVAwUBQ2fKdD5Ru2/4N2IFAQIEUQQAlpQMrJ1YeDOC4SggrVbxTgwr6HtZzSU6
Rl7F1fQybzN4tcUnYo3m20k57IKLr94SDOUI5rrL9O0qU8Oz/V7V8hI48Z82HXk9
gk2yFnWgeTYOOttSPXkEU7/ohDKibQXK6+1JTG3L3NTAAmphTBai0nxii0iNN9Vk
wdIxN4YcaqA=
=GnoS
-----END PGP SIGNATURE-----

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »