Authentication Bypass in OpenSSL AES-SIV and AES-GCM-SIV

Executive Summary

This vulnerability affects the implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) in OpenSSL. These are encryption modes designed to be resistant to nonce misuse and provide authenticated encryption with additional authenticated data (AAD). The issue arises when the ciphertext is empty but AAD is present.

In OpenSSL's implementation, the authentication tag is only recalculated during decryption if there is non-empty ciphertext data. If the ciphertext is empty, the tag remains at an all-zeros value and is not updated, which allows an attacker to forge messages with arbitrary AAD and empty ciphertext that will pass authentication.

For AES-GCM-SIV, an attacker can send arbitrary AAD with empty ciphertext and an all-zeros tag to successfully authenticate a message without knowing the key. For AES-SIV, the attack requires the application to reuse the decryption context without resetting the key.

This vulnerability only affects applications that implement their own protocols using these ciphers via the EVP interface and that skip the ciphertext update when receiving empty ciphertext messages. OpenSSL protocols like TLS, CMS, PKCS7, HPKE, and QUIC do not use these ciphers and are not affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to forge authenticated messages with empty ciphertext and arbitrary additional authenticated data (AAD). This means an attacker can create messages that appear valid and authenticated to the victim's application without knowing the encryption key.

Such forged messages could potentially be accepted by the application, leading to unauthorized actions or data manipulation depending on how the application processes these messages.

However, the impact is limited to applications that use AES-SIV or AES-GCM-SIV ciphers via OpenSSL's EVP interface and that handle empty ciphertext messages without proper checks. Standard OpenSSL protocols are not affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using AES-SIV and AES-GCM-SIV cipher implementations in OpenSSL versions 3.0 and 3.2 respectively, especially in applications that implement their own protocols using the EVP interface.

Ensure that applications do not skip the ciphertext update step when processing messages with empty ciphertext, as this is required to correctly compute the authentication tag.

Use OpenSSL FIPS modules (versions 4.0, 3.6, 3.5, 3.4, and 3.0) if possible, since these are not affected by this issue.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to forge empty messages with arbitrary Additional Authenticated Data (AAD) when using AES-SIV and AES-GCM-SIV implementations in OpenSSL. This could potentially lead to integrity issues in applications relying on these ciphers for authentication.

However, the CVE description does not provide specific information on how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from the mishandling of authentication of Additional Authenticated Data (AAD) with empty ciphertext in AES-SIV and AES-GCM-SIV implementations in OpenSSL. Detection involves identifying if your application uses these ciphers with OpenSSL versions 3.0 or later for AES-SIV and 3.2 or later for AES-GCM-SIV.

Since the vulnerability requires the application to use these specific ciphers and to process messages with empty ciphertext without invoking ciphertext update, detection on the network or system would involve monitoring for such usage patterns.

There are no specific commands provided in the available information to detect this vulnerability directly on your network or system.

Useful 0 Not Useful 0