Threat for the Secure Remote Password Protocol and a Leak in Apple’s Cryptographic Library

The Secure Remote Password protocol is a password-based authenticated key-exchange between two parties. One advantage is to prevent offline dictionary attacks from an adversary eavesdropping the communication. We present how such an attack is feasible if the modular exponentiation at the heart of the protocol is vulnerable and leaks some data related to the password.

In the case of a fixed exponent, adding randomness during the execution is a classical protection mechanism, and such a mechanism is present in Apple’s cryptographic library to randomize the exponent. Despite being intended to protect against complex side-channel attacks, we show that its usage makes the implementation vulnerable to simple side-channels such as power analysis.

This leakage observed in the library is mild but is useful for the attack we propose on the Secure Remote Password protocol.

1. 1.

   https://developer.apple.com/security/ (bottom of the page).

2. 2.

   No version number is indicated, but copyright notice and last file update refer to late 2019.

3. 3.

   https://support.apple.com/guide/security/welcome/web.

4. 4.

   In the file ccdh/src/ccdh_power_blinded.c.

5. 5.

   https://www.wireshark.org.

6. 6.

   https://frida.re.

7. 7.

   In the file ccec/src/ccec_mult.c.

The author would like to thanks the anonymous reviewers for their comments, Apple Product Security for their collaboration, and finally his colleague Cyril Delétré who provided the power trace captures.

Authors and Affiliations

1. Orange, Applied Crypto Group, Cesson-Sévigné, France

   Andy Russon

2. Univ. Rennes, CNRS, IRMAR - UMR 6625, 35000, Rennes, France

   Andy Russon

Corresponding author

Correspondence to Andy Russon .

Editors and Affiliations

1. Waseda University, Tokyo, Japan

   Kazue Sako

2. CISPA Helmholtz Center for Information Security, Saarbrücken, Germany

   Nils Ole Tippenhauer

A SRP Requests and Responses in iCloud Keychain Recovery

In this appendix, we present the HTTP request srp_init in the context described in Sect. 3.5.

The captures were made on a secondary device using Wireshark^{Footnote 5} and Frida^{Footnote 6} to export the TLS session keys for decryption.

Client’s side of the initialization phase of the SRP protocol in iCloud Keychain recovery.

Full size image

Server’s side of the initialization phase of the SRP protocol in iCloud Keychain recovery.

Full size image

In Fig. 11, the ephemeral value A is base64 encoded and corresponds to 256 bytes, consistent with the 2048-bit group. The server’s answer is given in Fig. 12, and contains the salt and ephemeral value B at the end of the data in the base64 string respBlob, each preceded by their length in bytes: 64 and 256.

We confirmed on the first device that the SRP protocol is executed to retrieve the same record and salt after signing in and out. The new record created for the first device is the one that is used on the secondary device when the experiment is repeated.

B Elliptic Curve and SPAKE2+

In this appendix, we present briefly the implementation of the exponentiation (scalar multiplication) with elliptic curves where the Euclidean splitting technique is also used. We first present the differences of the algorithm implementation, and the consequence on the password-based authenticated key-exchange protocol SPAKE2+, which can be attacked similarly as with SRP.

1.1 B.1 Elliptic Curve Scalar Multiplication

The elliptic curves named secp192r1, secp224r1, secp256r1, secp384r1, and secp521r1 share the same exponentiation algorithm that is implemented in the function ccec_mult.^{Footnote 7}

The whole exponentiation is given with generic group notations in Algorithm 4. It is randomized with the Euclidean splitting, but we note differences with the previous case of modular exponentiation:

• A padding to hide the bit length of the exponent x with the group order is applied [5];

• A padding is applied on the remainder of the Euclidean division, so the bit length of the remainder is hidden;

• The individual exponentiations are executed with the Montgomery ladder algorithm that leaks the bit length of the exponents.

With a padding on the remainder, the only variation in the execution of the ccec_mult function is the exponentiation with the quotient. As a consequence, the timing execution of the whole exponentiation leaks the bit length of the quotient. An approximation of the secret exponent can be done with timing analysis if the auxiliary processing before and after the call of the function can be controlled.

This issue has been addressed in the updated version of the library. The Montgomery ladder algorithm has been tweaked to make it work when leading bits are set to 0 using characteristics of the algorithm and the point addition formulas from co-Z arithmetic [13].

1.2 B.2 SPAKE2+

The SPAKE2+ protocol [6] is another PAKE protocol similar to the SRP protocol and shares properties such as protection against an eavesdropper or a Man in the Middle. In Apple’s library, it is solely used with elliptic curves.

The attack on SRP can be adapted to work with this protocol, and there are a few differences. The first is that two exponents are derived from the password, and, according to the source code of the library, the client computes two distinct exponentiations with these values. Since the exponentiation is vulnerable, it gives two distinguishers to run an offline dictionary attack. In the situation of the first variant, where the attacker is only an observer, this makes the filtering more effective.

Reprints and permissions

© 2021 Springer Nature Switzerland AG

Policies and ethics