wolfProvider AES-GCM Nonce Reuse Vulnerability

Executive Summary

wolfProvider before version 1.2.2 has a flaw where the 8-byte explicit AES-GCM nonce is generated once when the TLS write key is set and never changes per record. This means every TLS 1.2 and DTLS 1.2 AES-GCM record in a connection uses the same key and nonce pair. Reusing a key and nonce allows attackers to recover plaintext by XORing ciphertexts and forge authentication tags by leaking the GHASH key. AES-CCM, TLS 1.3, and non-TLS use are unaffected.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves reuse of AES-GCM nonces in wolfProvider before 1.2.2. Detection requires checking for identical key-nonce pairs in TLS/DTLS AES-GCM records. No specific commands are provided in the context to detect this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to decrypt encrypted TLS traffic by exploiting the reused key and nonce, exposing sensitive data. It also enables forging authentication tags, allowing tampering with messages without detection. Systems using vulnerable wolfProvider versions for TLS 1.2 or DTLS 1.2 AES-GCM are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or tampering with sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage due to exposure of protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade wolfProvider to version 1.2.2 or later to fix the nonce reuse issue. Ensure all TLS/DTLS AES-GCM implementations use unique nonces per record. Review and update cryptographic libraries to prevent similar vulnerabilities.

Useful 0 Not Useful 0