Session Token Reuse Due to Predictable Nonce in Krill

Executive Summary

The vulnerability involves Krill reusing the same (key, nonce) pair for encrypting login-session tokens after each restart. This happens because the nonce is generated from a counter that resets to 0 when Krill restarts, allowing potential reuse of encryption keys and nonces.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if Krill tokens are generated with predictable nonces after restart. Monitor Krill logs for repeated token generation patterns or identical (key, nonce) pairs. Inspect Krill configuration files for nonce generation settings. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to decrypt session tokens if they capture encrypted traffic and exploit the reuse of (key, nonce) pairs. This may lead to unauthorized access to user accounts or sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to session token reuse, potentially allowing unauthorized access to sensitive data. For GDPR, this may violate principles of data protection and security. For HIPAA, it could compromise protected health information integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Restart Krill to reset the nonce counter and ensure unique (key, nonce) pairs are used for each session token. Avoid frequent restarts to prevent reuse of nonce values.

Useful 0 Not Useful 0