Leak the Secret Key of Elgamal Encryption in Cryptopp via Rowhammer

------=_Part_36818_90105122.1708270273809
Content-Type: multipart/alternative; 
	boundary="----=_Part_36819_392019497.1708270273809"

------=_Part_36819_392019497.1708270273809
Content-Type: text/plain; charset="UTF-8"

Hi Team,

We are writing to report a potential security issue about the 
implementation of Elgamal Encryption in Cryptopp.
  
Specifically, we cloned Cryptopp-8.9 from cryptopp.com on February 1, 2024 
and analyzed the source code of the Elgamal encryption scheme (more 
precisely, elgamal.h 
<https://github.com/weidai11/cryptopp/blob/master/elgamal.h>). Based on our 
analysis, its decryption implementation (Line 78 in elgamal.h 
<https://github.com/weidai11/cryptopp/blob/master/elgamal.h#L78>}) is 
vulnerable to fault injection. 

As you may know, Rowhammer is a software-induced DRAM fault, which can 
induce bit flips in main memory that runs a commodity system. In our attack 
scenario, a malicious user process co-resides in the same system with a 
victim process that runs the Elgamal decryption of Cryptopp. As both 
processes share the main memory, the adversary can induce bit flips to the 
secret key before it is used by the victim to decrypt a ciphertext, 
resulting in a faulty decryption message. With enough faulty decryption 
messages released, the adversary can recover/leak the secret key. For more 
details of the analysis and possible countermeasures, they are provided in 
the attached pdf. 

Prior to this report, we have reported similar vulnerabilities in RSA 
encryption and EdDSA signature schemes implemented in WolfSSL. Its security 
team have acknowledged our findings, fixed RSA encryption via a commit 
<https://github.com/wolfSSL/wolfssl/commit/de4a6f9e00f6fbcaa7e20ed7bd89b5d50179e634> and 
EdDSA signature via another commit 
<https://github.com/wolfSSL/wolfssl/commit/c8d0bb0bd8fcd3dd177ec04e9a659a006df51b73>
.
Before our reports to WolfSSL, RSA signature in both WolfSSL and OpenSSL 
has been proven to be vulnerable to Rowhammer-based attacks. WolfSSL 
tracked the RSA signature vulnerability via CVE-2019-19962. OpenSSL fixed 
it by a commit 
<https://github.com/openssl/openssl/pull/7225/commits/02534c1ee3e84a1d6c59a887a67bd5ee81bcf6cf>
. 

If you have any question or need more details, please let us know. We are 
looking forward to your reply. Thank you.

Best Regards,

Junkai Liang (Peking University)

Zhi Zhang (The University of Western Australia)

Xin Zhang (Peking University)

Qingni Shen (Peking University)

-- 
You received this message because you are subscribed to the Google Groups "Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/cryptopp-users/ef8e5b92-d05f-4a6c-a090-34c6ac7df2edn%40googlegroups.com.

------=_Part_36819_392019497.1708270273809
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Team,<br /><br />We are writing to report a potential security issue abo=
ut the implementation of Elgamal Encryption in Cryptopp.<div>=C2=A0 <br />S=
pecifically, we cloned Cryptopp-8.9 from cryptopp.com on February 1, 2024 a=
nd analyzed the source code of the Elgamal encryption scheme (more precisel=
y, <a href=3D"https://github.com/weidai11/cryptopp/blob/master/elgamal.h">e=
lgamal.h</a>). Based on our analysis, its decryption implementation (Line 7=
8 in <a href=3D"https://github.com/weidai11/cryptopp/blob/master/elgamal.h#=
L78">elgamal.h</a>}) is vulnerable to fault injection. <br /><br />As you m=
ay know, Rowhammer is a software-induced DRAM fault, which can induce bit f=
lips in main memory that runs a commodity system. In our attack scenario, a=
 malicious user process co-resides in the same system with a victim process=
 that runs the Elgamal decryption of Cryptopp. As both processes share the =
main memory, the adversary can induce bit flips to the secret key before it=
 is used by the victim to decrypt a ciphertext, resulting in a faulty decry=
ption message. With enough faulty decryption messages released, the adversa=
ry can recover/leak the secret key. For more details of the analysis and po=
ssible countermeasures, they are provided in the attached pdf. <br /><br />=
Prior to this report, we have reported similar vulnerabilities in RSA encry=
ption and EdDSA signature schemes implemented in WolfSSL. Its security team=
 have acknowledged our findings, fixed RSA encryption via a <a href=3D"http=
s://github.com/wolfSSL/wolfssl/commit/de4a6f9e00f6fbcaa7e20ed7bd89b5d50179e=
634">commit</a>=C2=A0and EdDSA signature via another <a href=3D"https://git=
hub.com/wolfSSL/wolfssl/commit/c8d0bb0bd8fcd3dd177ec04e9a659a006df51b73">co=
mmit</a>.</div><div>Before our reports to WolfSSL, RSA signature in both Wo=
lfSSL and OpenSSL has been proven to be vulnerable to Rowhammer-based attac=
ks. WolfSSL tracked the RSA signature vulnerability via CVE-2019-19962. Ope=
nSSL fixed it by a <a href=3D"https://github.com/openssl/openssl/pull/7225/=
commits/02534c1ee3e84a1d6c59a887a67bd5ee81bcf6cf">commit</a>.=C2=A0<br /></=
div><div><br /></div><div>If you have any question or need more details, pl=
ease let us know. We are looking forward to your reply. Thank you.<br /><br=
 />Best Regards,<br /><br />Junkai Liang (Peking University)<br /><br />Zhi=
 Zhang (The University of Western Australia)<br /><br />Xin Zhang (Peking U=
niversity)<br /><br />Qingni Shen (Peking University)<br /></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cryptopp-users/ef8e5b92-d05f-4a6c-a090-34c6ac7df2edn%40googlegro=
ups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d=
/msgid/cryptopp-users/ef8e5b92-d05f-4a6c-a090-34c6ac7df2edn%40googlegroups.=
com</a>.<br />

------=_Part_36819_392019497.1708270273809--

------=_Part_36818_90105122.1708270273809--