[Paper] Lucky Thirteen: Breaking the TLS and DTLS Record Protocols
The Transport Layer Security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks. TLS has become the de facto secure protocol of choice for Internet and mobile applications. DTLS is a variant of TLS that is growing in importance. In this paper, we present distinguishing and plaintext recovery attacks against TLS and DTLS. The attacks are based on a delicate timing analysis of decryption processing in the two protocols. We include experimental results demonstrating the feasibility of the attacks in realistic network environments for several different implementations of TLS and DTLS, including the leading OpenSSL implementations. We provide countermeasures for the attacks. Finally, we discuss the wider implications of our attacks for the cryptographic design used by TLS and DTLS.
Keywords: TLS, DTLS, CBC-mode encryption, timing attack, plaintext recovery
Which versions of TLS and DTLS are affected?
The attacks apply to all TLS and DTLS implementations that are compliant with TLS 1.1 or 1.2, or with DTLS 1.0 or 1.2. They also apply to implementations of SSL 3.0 and TLS 1.0 that incorporate countermeasures to previous padding oracle attacks. Variant attacks may also apply to non-compliant implementations.
Details:
- Authors: Nadhem J. AlFardan and Kenneth G. Paterson
- Date: 27th February 2013
More Information:
Download (PDF): Lucky Thirteen: Breaking the TLS and DTLS Record Protocols
