IV Discard in OpenSSL AES-OCB Encryption

Executive Summary

This vulnerability occurs when an application uses the AES-OCB cipher with the OpenSSL EVP_Cipher() one-shot interface. In this case, the initialization vector (IV) supplied by the application is silently discarded, causing every message encrypted under the same key to use the same effective nonce.

Because the IV is ignored, the same (key, nonce) pair is reused, which compromises confidentiality. Additionally, if the authentication tag is computed using EVP_EncryptFinal_ex(), the tag depends only on the (key, IV) pair and not on the actual plaintext or ciphertext. This allows an attacker to forge arbitrary ciphertexts from a single captured message.

The issue arises because the one-shot EVP_Cipher() handler does not properly incorporate the IV into the OCB context, unlike the streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) which is not affected. This vulnerability affects only applications that use AES-OCB with the EVP_Cipher() one-shot API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to loss of confidentiality because the same nonce is reused for multiple messages encrypted with the same key, which breaks the security guarantees of AES-OCB encryption.

Furthermore, it enables universal forgery of arbitrary ciphertexts from a single captured message, meaning an attacker can create valid encrypted messages without knowing the encryption key.

However, this vulnerability does not affect OpenSSL's SSL/TLS implementation or applications using the recommended streaming AEAD API, only those using the one-shot EVP_Cipher() interface with AES-OCB.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using the EVP_Cipher() one-shot interface with the AES-OCB cipher.

Instead, use the documented streaming AEAD API, specifically EVP_CipherUpdate() and EVP_CipherFinal_ex(), which are not affected by this issue.

Also, note that the OpenSSL SSL/TLS implementation and FIPS modules are not affected by this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes loss of confidentiality due to nonce reuse and allows universal forgery of ciphertext, which compromises data security.

Such a loss of confidentiality can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive data against unauthorized access and tampering.

However, the vulnerability only affects applications using the AES-OCB cipher with the EVP_Cipher() one-shot API, and not those using the recommended streaming interface or OpenSSL's SSL/TLS implementation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from the use of the EVP_Cipher() one-shot API with AES-OCB in OpenSSL, where the Initialization Vector (IV) is silently discarded, causing nonce reuse and enabling forgery attacks.

Detection on a network or system would involve identifying applications that use OpenSSL's AES-OCB cipher via the EVP_Cipher() one-shot interface rather than the recommended streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex).

Since the vulnerability is specific to the use of EVP_Cipher() with AES-OCB, detection commands would focus on:

• Checking the OpenSSL version in use to determine if it is vulnerable (versions before the fix commit).
• Auditing application binaries or source code for usage of EVP_Cipher() with AES-OCB.
• Monitoring network traffic for repeated ciphertexts or authentication tags that indicate nonce reuse under the same key.

Specific commands might include:

• To check OpenSSL version: `openssl version`
• To search for EVP_Cipher usage in source code: `grep -r EVP_Cipher /path/to/source`
• To monitor network traffic for nonce reuse, use packet capture tools like tcpdump or Wireshark and analyze for repeated nonces or tags in AES-OCB encrypted messages.

However, no direct detection commands or signatures are provided in the available resources.

Useful 0 Not Useful 0